Each alert type watches one thing on your domains. To learn more about alerts, read the Overview page.

Availability

Alerts are being rolled out and may not appear in your organization yet.

Alert types

The following alerts are opened when a problem is found in a record or hosted service, and are resolved when no problems remain:

AlertWatchesRequires
DMARC record healthDMARC record–
SPF record healthSPF record and its resolution chain–
TLSRPT record healthTLSRPT recordSMTP TLS reporting
Hosted DMARC healthCNAME recordHosted DMARC
Hosted MTA-STS healthCNAME records and certificateHosted MTA-STS

Check Settings → Alerts for the alert rules currently enabled in your organization.

DMARC record health

Watches the published DMARC record of your domains.

This alert rule can be configured to alert on Errors only or on Errors and warnings:

Errors only Default
  • Multiple DMARC records published
  • Validation errors:
    • Leading whitespace
    • Missing policy tag
    • Invalid tag value
    • Duplicate tags
    • Misplaced mailto URI
Errors and warnings

Everything in Errors only, plus:

  • Validation warnings:
    • Invalid position of the policy tag
    • Invalid tag name

Removing the record or a reporting address, or using a policy of none, doesn’t cause this alert to be opened.

To investigate, open the domain’s DMARC page. See DMARC checks and validation for more information.

SPF record health

Watches the SPF record of your domains and its resolution chain, including records reached through include and redirect.

This alert rule can be configured to alert on Errors only or on Errors and warnings:

Errors only Default

In the record

  • Multiple SPF records published
  • Validation errors:
    • Leading whitespace
    • Unknown mechanism
    • Invalid mechanism value
    • Invalid modifier name
    • Invalid modifier value
    • Duplicate modifier
    • Misplaced domain or network

In the resolution chain

  • More than 10 DNS lookups
  • More than 2 void lookups
  • An mx mechanism over 10 address lookups
  • A loop
  • An invalid record
  • A record missing for an include or redirect
Errors and warnings

Everything in Errors only, plus:

In the record

  • Validation warnings:
    • Missing fallback
    • Directives after all
    • redirect together with all
    • Unknown modifier
    • Deprecated ptr mechanism
    • Misaligned CIDR prefix

In the resolution chain

  • Transient DNS lookup failures and timeouts

Additional things to know:

  • A slow SPF chain resolution or a suggestion to use ~all or -all doesn’t cause this alert to be opened.
  • New problems can notify again during an active alert (alert escalation), while another occurrence of the same problem doesn’t notify again.

To investigate, open the domain’s SPF page. See SPF checks and validation for more information.

TLSRPT record health

Watches the published SMTP TLS reporting record of your domains.

This alert rule requires the SMTP TLS reporting plan feature.

This alert rule can be configured to alert on Errors only or on Errors and warnings:

Errors only Default
  • Multiple TLSRPT records published
  • Validation errors:
    • Leading whitespace
    • Missing reporting URI (rua)
    • Invalid URI
    • Duplicate field
    • Misplaced URI
    • Invalid spacing
Errors and warnings

Everything in Errors only, plus:

  • Validation warnings:
    • Unknown field
    • Extra semicolon

Additional things to know:

  • Removing the record or a reporting destination doesn’t cause this alert to be opened.
  • Removing the record or downgrading to a plan without the SMTP TLS feature closes the active alert without sending a notification.

To investigate, open the domain’s TLSRPT page. See TLSRPT checks and validation.

Hosted DMARC health

Watches the _dmarc CNAME record on your domain that points to the DMARC record hosted by DMARCwise.

This alert rule requires the hosted DMARC plan feature.

An alert with Error severity is opened when, after the CNAME record for a domain was set up:

  • the CNAME record is removed, or
  • the CNAME points somewhere else, or
  • a TXT record is published in place of the CNAME record.

Until the CNAME record is restored, the DMARC record hosted by DMARCwise isn’t published and settings changes you make in the dashboard have no effect.

Additional things to know:

  • There’s no alert right after you enable hosted DMARC, before the CNAME record is published.
  • The DMARC record health alert keeps watching the record that is actually published, including when the CNAME record is replaced with a DMARC TXT record.
  • Disabling hosted DMARC, or its suspension after the subscription is canceled, closes the active alert without sending a notification.

To investigate issues related to this alert, open Hosted services → DMARC for the affected domain and follow the instructions to restore the CNAME record. See Hosted DMARC.

Hosted MTA-STS health

Watches the DNS records and HTTPS certificate for your MTA-STS policy hosted by DMARCwise.

This alert rule requires the hosted MTA-STS plan feature.

An alert with Error severity is opened when:

  • The discovery CNAME record is missing, incorrect, or published more than once.
  • The policy host CNAME record is missing, incorrect, or published more than once.
  • The hosted policy certificate can’t be issued or renewed as expected.

Additional things to know:

  • There’s no alert right after you enable hosting, before either CNAME is published and before the certificate has been checked.
  • Monitoring continues while the service is retiring, including after a plan downgrade, and stops when MTA-STS hosting is fully disabled.

To investigate issues related to this alert, open Hosted services → MTA-STS for the affected domain and restore the CNAME records shown there if they’re incorrect.

If the DNS records are valid but the certificate still requires attention, contact support. See Managing MTA-STS policies.