What will alert me, when, and how often?
On every plan
An alert tells you that something changed for one of your domains: a new source, a drop in the mail that passes DMARC, a broken DNS record, or reports that stopped. We look after every report, after every DNS check and once an hour. Each member gets alert emails at most as often as the plan allows, from one alert email a week on Starter to one alert email an hour on Enterprise.
Every kind of alert
| Alert | What sets it off | Plans | Standard thresholds | Sensitive thresholds |
|---|---|---|---|---|
| New source | A service or address starts sending as your domain. | Pro, Teams and Enterprise | Minimum messages: 50 | Minimum messages: 25 |
| Drop in the pass rate | The share of your mail that passes DMARC falls by at least the points you set, compared with the days before. | Pro, Teams and Enterprise | Days compared: 3 Days before them: 14 Drop in percentage points: 10 Clears under, in points: 5 Minimum messages: 100 | Days compared: 3 Days before them: 14 Drop in percentage points: 5 Clears under, in points: 2 Minimum messages: 50 |
| DNS record changed | A DMARC, SPF, DKIM, MX, MTA-STS, TLS-RPT or BIMI record changes. | Every plan | – | – |
| DNS error | A DNS check finds an error in a record. | Every plan | – | – |
| DKIM key missing | A DKIM key used in recent mail disappears from DNS. | Every plan | – | – |
| Reports stopped | No report arrives for a domain that used to get them. | Every plan | Hours without a report: 72 | Hours without a report: 72 |
| Ready for a stricter policy | The domain meets the readiness rule for the next policy step. | Pro, Teams and Enterprise | – | – |
| DMARC policy changed | The DMARC policy changes. | Pro, Teams and Enterprise | – | – |
| Forensic reports | Forensic reports arrive. You get one alert per day, with the count. | Pro, Teams and Enterprise | – | – |
| TLS failures | Mail servers report failed TLS connections to yours on a day. | Pro, Teams and Enterprise | Minimum failed sessions: 10 Minimum failed share, in percent: 1 | Minimum failed sessions: 10 Minimum failed share, in percent: 1 |
The thresholds come in two sets, standard and sensitive. The plan table says which plans use which. From Teams up, an admin can set each domain's thresholds.
Some kinds need a closer look:
- A new source alerts at once if it is a service we recognize or a source you named, or if any of its mail passes DMARC. Any other source alerts only if it sends the minimum number of messages within 7 days of first appearing.
- A drop in the pass rate compares the last complete days with the days before them. Both stretches need the minimum number of messages. Sources we cannot name whose mail never passes are left out: that mail is probably someone else sending as you, and it says nothing about your own services.
- The alert for reports that stopped opens only for a domain that got reports regularly: on at least 7 days in the 30 days before its last report. It clears when a report arrives.
- The forensic reports alert is off until an admin turns it on for the domain.
- The readiness alert tells you when a domain meets the readiness rule for its next step.
When we look
We check a domain's alerts after every report we store, after every DNS check, and once an hour. Only verified domains get alerts. A subdomain is covered by its domain's alerts.
Alerts that stay quiet
Some alerts are recorded but not sent. In the first two cases below, the alerts list shows the alert and why it was not sent.
- The first check of a rule. The first time a rule runs, it records what it finds and sends nothing. The same goes for a rule an admin turns back on.
- The first week of reports. For 7 days after a domain's first report, alerts about new sources, drops in the pass rate, forensic reports and TLS failures stay quiet. In those days every source is new.
- A problem that cleared in time. A problem that clears before its email goes out is not sent, and neither is its all-clear.
How alerts reach you
Each alert email waits 10 minutes for others to join it. After that, each member gets at most:
- Starter: one alert email a week
- Pro: one alert email a day
- Teams: one alert email an hour
- Enterprise: one alert email an hour
Alerts that come in between arrive together in the next email.
Some alerts describe a state that lasts, such as a DNS error or reports that stopped. These stay open until the state ends, and whoever was told one opened is told when it clears. The others describe a moment, and you hear about them once.
A DNS error stays open while we cannot read the record itself, because a check that could not read it says nothing about it. It closes when a check reads the record and finds the problem gone, even if that check could not fetch an SPF include, an MTA-STS policy file or a BIMI logo. The DNS tab shows that failure on its own.
Admins get alert emails unless they turn them off. Viewers do not, unless they turn them on. Each member sets this under Settings, Notifications. From Teams up, an admin can add shared channels on the same page, such as Slack. Channels do not follow the email pace.
Turning alerts on and off
On every plan, an admin turns each kind your plan includes on or off for a domain, on its Alerts page. From Teams up, the admin can also change the thresholds there, and choose which channels get each kind.
The alerts list
The Alerts page shows every open alert, and the alerts that started in the last 30 days and have ended. We delete an alert 13 months after it ends, on every plan.
Published 27 October 2026 · Checked 27 October 2026