Configuring Alerts and Notifications

MailSentinel provides configurable alerts to notify you when email authentication issues occur. This guide shows you how to set up and manage alerts.

Overview

MailSentinel can alert you about:

DMARC Failures - Emails failing authentication
SPF Issues - SPF validation problems
DKIM Problems - DKIM signing failures
DNS Changes - Unauthorized DNS record modifications
Policy Violations - DMARC policy enforcement issues

Step 1: Access Alert Settings

Log in to your MailSentinel dashboard
Click Settings in the sidebar
Go to Alerts tab
You'll see alert configuration options

Step 2: Configure Email Notifications

Add Notification Email

In Alert Settings, find Notification Emails
Click Add Email
Enter your email address
Click Verify Email
Check your inbox for verification link
Click the verification link

Multiple Notification Emails

You can add multiple email addresses:

Primary email - Main contact
Team emails - Additional team members
Escalation emails - For critical issues

Step 3: Configure Alert Types

DMARC Failure Alerts

When to Alert:

Emails failing DMARC authentication
DMARC pass rate drops below threshold
Policy violations detected

Configuration:

Enable DMARC Failure Alerts
Set Threshold (e.g., alert if pass rate < 95%)
Choose Frequency:
- Immediate - Alert as soon as issue detected
- Daily Digest - Summary once per day
- Weekly Summary - Summary once per week

Recommended Settings:

Threshold: 95% pass rate
Frequency: Daily digest for monitoring
Immediate for critical domains

SPF Validation Alerts

When to Alert:

SPF record not found
SPF validation errors
Too many DNS lookups
SPF record changes

Configuration:

Enable SPF Validation Alerts
Choose alert conditions:
- SPF record missing
- SPF validation fails
- DNS lookup limit exceeded
- SPF record changed

Recommended Settings:

Alert on all conditions
Immediate notifications
Critical for email deliverability

DKIM Signing Alerts

When to Alert:

DKIM records missing
DKIM validation failures
DKIM key expiration warnings

Configuration:

Enable DKIM Signing Alerts
Choose alert conditions:
- DKIM record missing
- DKIM validation fails
- Key expiration warning (30 days)

Recommended Settings:

Alert on all conditions
Immediate notifications
Monitor key expiration

DNS Change Alerts

When to Alert:

DMARC record changed
SPF record modified
DKIM records updated
Unauthorized DNS changes

Configuration:

Enable DNS Change Alerts
Choose which records to monitor:
- DMARC records
- SPF records
- DKIM records
- All DNS records

Recommended Settings:

Monitor all authentication records
Immediate notifications
Critical for security

Step 4: Set Alert Thresholds

DMARC Pass Rate Threshold

Recommended Thresholds:

Critical: < 90% pass rate
Warning: < 95% pass rate
Info: < 98% pass rate

How to Set:

Go to DMARC Alerts
Set Pass Rate Threshold
Choose alert level

Volume Thresholds

For High-Volume Domains:

Alert if failure volume > 1000/day
Alert if failure rate > 5%
Alert on sudden spikes

For Low-Volume Domains:

Alert on any failures
Alert if failure rate > 1%
More sensitive thresholds

Step 5: Configure Alert Frequency

Immediate Alerts

Use For:

Critical issues
Security concerns
DNS changes
High-priority domains

Configuration:

Enable Immediate Notifications
Set up email/SMS/webhook
Configure escalation rules

Daily Digest

Use For:

Monitoring mode
Non-critical issues
Summary reports
General awareness

Configuration:

Enable Daily Digest
Set delivery time (e.g., 9 AM)
Include summary statistics

Weekly Summary

Use For:

Long-term monitoring
Trend analysis
Management reports
Low-priority alerts

Configuration:

Enable Weekly Summary
Set delivery day (e.g., Monday)
Include weekly statistics

Step 6: Set Up Webhooks (Advanced)

Configure Webhook Endpoint

For Integration:

Slack notifications
Microsoft Teams alerts
Custom integrations
Automated responses

Configuration:

Go to Webhooks section
Click Add Webhook
Enter webhook URL
Choose events to send
Test webhook
Save configuration

Webhook Payload

Example Payload:

{
  "event": "dmarc_failure",
  "domain": "example.com",
  "timestamp": "2024-01-15T10:30:00Z",
  "details": {
    "pass_rate": 85.5,
    "failure_count": 150,
    "failure_reasons": ["SPF fail", "DKIM fail"]
  }
}