Slack Integration
Get DDMARC alerts in Slack. There is no DDMARC app to install: you create an incoming webhook in your own Slack workspace and paste the URL into DDMARC.
How this works
- • Slack issues an incoming-webhook URL that is permanently bound to one channel. DDMARC stores that URL and POSTs to it.
- • The channel is chosen in Slack, when you create the webhook. DDMARC has no channel picker because it cannot see your channel list.
- • There is no bot user, no OAuth authorization to expire, and no slash command. Nothing needs to be invited to the channel.
- • The webhook URL is stored per user. Two people in the same organization can point at two different channels; one person cannot route different alerts to different channels.
Setup Instructions
Create an incoming webhook in Slack
In Slack, create an app for your workspace (or open an existing one), enable Incoming Webhooks, then click Add New Webhook to Workspace and pick the channel that should receive alerts. Slack returns a URL that looks like this:
Creating an app may require a workspace admin, depending on your Slack settings.
Paste the URL into DDMARC
In the DDMARC dashboard, open notification settings, paste the URL into the webhook field and enable webhook notifications.
Dashboard → Notifications → Settings → Webhook NotificationsDDMARC recognises the hooks.slack.com host and formats messages for Slack automatically. There is nothing else to select.
Send a test message
Use the Send test action next to the field. A test alert should appear in the channel within a second or two. You can also trigger it over the API:
POST /api/v1/alerts/webhook/testcurl -X POST "https://api.ddmarc.com/api/v1/alerts/webhook/test" \
-H "X-API-Key: $DDMARC_API_KEY" \
-H "Content-Type: application/json" \
-d '{ "url": "https://hooks.slack.com/services/T00.../B00.../XXX" }'The response is always 200; read the success field to see whether Slack accepted it.
Choose what fires
The alert-type toggles and thresholds on the same settings page decide what raises an alert at all. For anything conditional — "pass rate below 95% on this domain" — create an alert rule and include the webhook channel on it.
What the Message Looks Like
Each alert is posted as three Slack blocks: a header with a severity emoji, the alert message, and a context line. There are no buttons or interactive elements — act on the alert in the DDMARC dashboard.
High failure rate on example.com
32% of messages failed DMARC in the last hour, above your 20% threshold.
Type: high_failure_rate | Severity: critical
The emoji tracks severity: a red circle for critical, a warning sign for warning, and an info symbol for info. The affected domain appears in the message text rather than as a separate field.
What You Can Be Alerted About
Authentication failures
DMARC, SPF or DKIM failures, and a high overall failure rate against your threshold.
New senders
A sending source appears on one of your domains for the first time.
DNS record changes
A monitored record changes, regresses to invalid, or recovers. Useful for catching a colleague editing a zone file.
Policy rollouts
A rollout starts, advances a stage, is blocked, or completes.
Custom rules
Anything you express as an alert rule: a metric, an operator, a threshold and a cooldown.
Daily and weekly digests are email only. Slack receives individual alerts as they fire, not a batched summary.
Defaults
These are the out-of-the-box notification settings. All of them are editable.
| Setting | Default |
|---|---|
| DMARC / SPF / DKIM failure alerts | Enabled |
| DNS issue alerts | Enabled |
| New sender alerts | Enabled |
| New report received | Disabled |
| High failure rate threshold | 20% of messages |
| Forensic spike threshold | 5 reports in 24 hours |
| Digest frequency | Immediate (no batching) |
| Digest delivery hour | 08:00 UTC |
The failure-rate threshold is a percentage of messages, not a count per hour. Delivery hours are UTC.
Known limits
- • One URL per user. You cannot route critical alerts to one channel and everything else to another.
- • No retries. If Slack returns an error or the request times out after 10 seconds, that message is not resent. The alert is still visible in the dashboard.
- • No interactive actions. Acknowledging, snoozing and marking senders as known all happen in DDMARC.
- • Alert rules scope by domain, not by channel. A rule can watch a single domain, but it still delivers to the same webhook URL.
The plan matrix lists Slack and Discord alerting from the Protect plan upward.
Troubleshooting
The test says success but nothing appears in Slack
The webhook is bound to the channel chosen when it was created, which may not be the one you are watching. Check the app's Incoming Webhooks page in Slack to see the target channel.
The test fails with a URL validation error
The URL must be HTTPS and must resolve to a public address. Internal hostnames, private ranges and cloud metadata addresses are refused before any request is made.
Slack returns 404 or invalid_token
The webhook was revoked, or the Slack app was removed from the workspace. Create a new incoming webhook and paste the new URL.
Alerts stopped arriving
Check that webhook notifications are still enabled and the URL is still saved, then confirm the alerts are actually being raised by looking at the notifications page in the dashboard.
Too much noise
Raise the failure-rate threshold, turn off the alert types you do not act on, and set a cooldown on any custom rules so one incident does not fire repeatedly.