Custom Alert Rules
A rule watches one metric on one domain (or all of them), compares it to a threshold you set, and raises an alert on the channels you choose. The evaluation engine runs every five minutes.
Anatomy of a rule
A rule is a structured record, not a query language. These are all the fields:
| Field | Value |
|---|---|
| Name | Up to 120 characters. Shown on the alert. |
| Description | Optional, up to 500 characters. |
| Metric | One of the seven metrics listed below. |
| Operator | lt, lte, gt, gte or eq. |
| Threshold | A number. Its meaning depends on the metric. |
| Severity | critical, warning or info. |
| Domain | A single domain, or leave it empty to apply the rule to every domain in the organization. |
| Notification channels | Any of email, webhook, teams, telegram. |
| Cooldown | Minutes between repeat alerts. Default 60, maximum 10080 (one week). |
| Enabled | Disable a rule to pause it without deleting it. |
Example rule
The seven metrics
Rate and count metrics are computed over a rolling 24-hour window. Read the units carefully — the threshold means something different for each metric.
Pass rate
pass_rateThreshold unit
Percentage (0–100)
Share of mail in the last 24 hours where both DKIM and SPF passed. No data in the window means no alert.
Failure count
fail_countThreshold unit
Number of messages
Count of failing messages in the last 24 hours.
SPF failure rate
spf_fail_rateThreshold unit
Percentage (0–100)
Share of mail in the last 24 hours where SPF failed.
DKIM failure rate
dkim_fail_rateThreshold unit
Percentage (0–100)
Share of mail in the last 24 hours where DKIM failed.
DNS change
dns_changeThreshold unit
Presence test
Fires when a DNS check has flagged a change since the last evaluation. The operator and threshold are ignored for this metric.
Volume change
volume_changeThreshold unit
Signed percentage
Last 24 hours against the average day over the previous 7 days. Positive is a rise, negative a fall — so gt 100 catches a doubling and lt -50 catches a halving. Domains averaging under 50 messages a day are skipped.
New senders
new_senderThreshold unit
Number of sources
Sending sources first detected since this rule was last evaluated.
Comparison operators
Five operators are accepted. There is no "changes" or "contains" operator — to alert on a DNS record changing, use the dns_change metric.
| Operator | API value | Symbol | Example |
|---|---|---|---|
| Less than | lt | < | Pass rate lt 90 |
| Less than or equal | lte | ≤ | Pass rate lte 95 |
| Greater than | gt | > | Failure count gt 100 |
| Greater than or equal | gte | ≥ | New senders gte 3 |
| Equals | eq | = | Failure count eq 0 |
Cooldown and deduplication
A rule is evaluated every five minutes. Without a cooldown, a condition that stays true would alert twelve times an hour. The cooldown is the minimum gap between repeat alerts, and it is the only deduplication mechanism — there is no configurable alert grouping.
- • Default is 60 minutes; the range is 0 to 10080 (one week).
- • Cooldown is tracked per (rule, domain) pair. An all-domains rule that has just fired for a.example can still fire immediately for b.example.
- • Setting it to 0 means every matching evaluation raises an alert. Use that only for metrics that are naturally rare.
- • Lengthening the cooldown is the first lever to pull when a rule is too noisy — before disabling it.
Notification channels
A rule can target any combination of four channel values. Slack and Discord are delivered through webhook; they are not separate selections. Configure the destination for each channel once in Notifications → Settings.
Email email
Emails the organization's users
Webhook webhook
Your webhook URL — Slack and Discord URLs are auto-formatted
Microsoft Teams teams
Your Teams incoming webhook
Telegram telegram
Your Telegram bot and chat
Managing rules
Enable / disable
Pause a rule without losing its configuration or its fire history.
Check its history
Each rule reports when it was last evaluated, when it last fired, and how many times it has fired in total.
Delete
Remove a rule for good. Alerts it already raised stay in the Notifications centre.
Snoozing applies to alerts, not rules. If a rule has already fired and you want quiet for the next few hours, snooze the alert in the Notifications centre. To silence the rule itself, disable it or extend its cooldown.
Alert rules API
| Endpoint | Purpose |
|---|---|
| GET /api/v1/alerts/rules | List your rules with their evaluation history |
| POST /api/v1/alerts/rules | Create a rule (rate limited to 30 per minute) |
| PATCH /api/v1/alerts/rules/{rule_id} | Update any field, including enabling or disabling |
| DELETE /api/v1/alerts/rules/{rule_id} | Delete a rule |
How many rules you can have
| Plan | Custom rules |
|---|---|
| Monitor (free) | Not available |
| Protect | 3 rules |
| Growth | 10 rules |
| Professional | 25 rules |
| Enterprise | Unlimited |
| Partner Starter / Partner | Unlimited |
Channel availability follows your plan too: webhook (including Slack and Discord) from Protect, Teams and Telegram from Growth.
Not available yet — Configurable alert grouping
Alerts cannot be grouped by domain, type or severity. The Notifications centre groups them by day and lets you filter by severity and read state; repeat suppression is handled entirely by the per-domain cooldown described above.
Writing rules that stay useful
- Watch your real numbers for a week before choosing a threshold. A pass-rate floor set above your normal baseline fires constantly and gets muted.
- Leave the domain empty for org-wide guardrails, and create domain-specific rules only where a domain genuinely behaves differently — you have a limited number of rules.
- Match severity to the response you actually want. If nobody is paged, it is not critical.
- Check the fire count occasionally. A rule that has never fired may have a threshold that is unreachable.