# Alert rules reference
Each alert type watches one thing on your domains. To learn more about alerts, read the [Overview](/docs/alerts) page.
Alerts are being rolled out and may not appear in your organization yet.
## Alert types
The following alerts are opened when a problem is found in a record or hosted service, and are resolved when no problems remain:
| Alert | Watches | Requires |
| ----------------------------------------------- | ----------------------------------- | ------------------ |
| [DMARC record health](#dmarc-record-health) | DMARC record | – |
| [SPF record health](#spf-record-health) | SPF record and its resolution chain | – |
| [TLSRPT record health](#tlsrpt-record-health) | TLSRPT record | SMTP TLS reporting |
| [Hosted DMARC health](#hosted-dmarc-health) | CNAME record | Hosted DMARC |
| [Hosted MTA-STS health](#hosted-mta-sts-health) | CNAME records and certificate | Hosted MTA-STS |
Check **Settings** → **Alerts** for the alert rules currently enabled in your organization.
## DMARC record health
Watches the published DMARC record of your domains.
This alert rule can be configured to alert on **Errors only** or on **Errors and warnings**:
- Multiple DMARC records published
- Validation errors:
- Leading whitespace
- Missing policy tag
- Invalid tag value
- Duplicate tags
- Misplaced `mailto` URI
Everything in Errors only, plus:
- Validation warnings:
- Invalid position of the policy tag
- Invalid tag name
Removing the record or a reporting address, or using a policy of `none`, doesn't cause this alert to be opened.
To investigate, open the domain's **DMARC** page. See [DMARC checks and validation](/docs/dmarc/checks) for more information.
## SPF record health
Watches the SPF record of your domains and its [resolution chain](/docs/spf/resolution-chain), including records reached through `include` and `redirect`.
This alert rule can be configured to alert on **Errors only** or on **Errors and warnings**:
#### In the record
- Multiple SPF records published
- Validation errors:
- Leading whitespace
- Unknown mechanism
- Invalid mechanism value
- Invalid modifier name
- Invalid modifier value
- Duplicate modifier
- Misplaced domain or network
#### In the resolution chain
- More than 10 DNS lookups
- More than 2 void lookups
- An `mx` mechanism over 10 address lookups
- A loop
- An invalid record
- A record missing for an `include` or `redirect`
Everything in Errors only, plus:
#### In the record
- Validation warnings:
- Missing fallback
- Directives after `all`
- `redirect` together with `all`
- Unknown modifier
- Deprecated `ptr` mechanism
- Misaligned CIDR prefix
#### In the resolution chain
- Transient DNS lookup failures and timeouts
Additional things to know:
- A slow SPF chain resolution or a suggestion to use `~all` or `-all` doesn't cause this alert to be opened.
- New problems can notify again during an active alert (alert escalation), while another occurrence of the same problem doesn't notify again.
To investigate, open the domain's **SPF** page. See [SPF checks and validation](/docs/spf/checks) for more information.
## TLSRPT record health
Watches the published SMTP TLS reporting record of your domains.
This alert rule requires the **SMTP TLS reporting** plan feature.
This alert rule can be configured to alert on **Errors only** or on **Errors and warnings**:
- Multiple TLSRPT records published
- Validation errors:
- Leading whitespace
- Missing reporting URI (`rua`)
- Invalid URI
- Duplicate field
- Misplaced URI
- Invalid spacing
Everything in Errors only, plus:
- Validation warnings:
- Unknown field
- Extra semicolon
Additional things to know:
- Removing the record or a reporting destination doesn't cause this alert to be opened.
- Removing the record or downgrading to a plan without the SMTP TLS feature closes the active alert without sending a notification.
To investigate, open the domain's **TLSRPT** page. See [TLSRPT checks and validation](/docs/tlsrpt/checks).
## Hosted DMARC health
Watches the `_dmarc` CNAME record on your domain that points to the DMARC record [hosted by DMARCwise](/docs/dmarc/hosted).
This alert rule requires the **hosted DMARC** plan feature.
An alert with **Error** severity is opened when, after the CNAME record for a domain was set up:
- the CNAME record is removed, or
- the CNAME points somewhere else, or
- a TXT record is published in place of the CNAME record.
Until the CNAME record is restored, the DMARC record hosted by DMARCwise isn't published and settings changes you make in the dashboard have no effect.
Additional things to know:
- There's no alert right after you enable hosted DMARC, before the CNAME record is published.
- The [DMARC record health](#dmarc-record-health) alert keeps watching the record that is actually published, including when the CNAME record is replaced with a DMARC TXT record.
- Disabling hosted DMARC, or its suspension after the subscription is canceled, closes the active alert without sending a notification.
To investigate issues related to this alert, open **Hosted services** → **DMARC** for the affected domain and follow the instructions to restore the CNAME record. See [Hosted DMARC](/docs/dmarc/hosted).
## Hosted MTA-STS health
Watches the DNS records and HTTPS certificate for your MTA-STS policy hosted by DMARCwise.
This alert rule requires the **hosted MTA-STS** plan feature.
An alert with **Error** severity is opened when:
- The discovery CNAME record is missing, incorrect, or published more than once.
- The policy host CNAME record is missing, incorrect, or published more than once.
- The hosted policy certificate can't be issued or renewed as expected.
Additional things to know:
- There's no alert right after you enable hosting, before either CNAME is published and before the certificate has been checked.
- Monitoring continues while the service is [retiring](/docs/mta-sts/retirement), including after a plan downgrade, and stops when MTA-STS hosting is fully disabled.
To investigate issues related to this alert, open **Hosted services** → **MTA-STS** for the affected domain and restore the CNAME records shown there if they're incorrect.
If the DNS records are valid but the certificate still requires attention, [contact support](/@/support). See [Managing MTA-STS policies](/docs/mta-sts/managing-policies).