Understanding alerts

DMARCER keeps an eye on your domains around the clock and lets you know the moment something changes that could affect your email security or your control of a domain. Alerts show up in the in-app notification centre, can be emailed to you, and (for MSPs) can be turned into PSA tickets automatically. You decide which alerts you receive, and where they go, in Alert Settings.

Severity levels

• Info: a change worth knowing about, with nothing urgent for you to do.
• Warning: something that needs your attention soon, such as lost reporting or a knock to your reputation.
• Critical: an active problem that is breaking email authentication right now and should be fixed straight away.

Authentication and policy

• SPF lookup limit exceeded (critical): your SPF record now needs more than 10 DNS lookups, which is over the limit allowed by the standard. This counts as a permanent error, so receiving mail servers treat SPF as broken and your DMARC checks based on SPF will fail.
• Multiple SPF records (critical): more than one SPF record (a TXT record starting with v=spf1) is published. This is also treated as a permanent error and breaks SPF, so the records need to be combined into a single one.
• SPF record has critical issues (critical): there is a problem inside the SPF record, such as records that point round in a loop, too many lookups that lead nowhere, an entry that resolves to too many mail servers, or rules placed after the part that is meant to end the record.
• DNSSEC disabled (info): DNSSEC is no longer switched on for the domain.

Reporting and verification

• DMARC reporting lost (warning): the regular DMARC summary reports have stopped reaching DMARCER, usually because the reporting address in your DMARC record (the rua= part) has changed.
• Ownership verification lost (warning): the DMARCER ownership record we look for can no longer be found, so the domain is no longer verified and is left out of reporting until you confirm ownership again.

Reputation

• Listed on a blacklist (warning): the domain, or one of its mail-server addresses, has appeared on a blocklist. Blacklist Monitoring shows you the link to request removal.
• Lost whitelist trust (info): the domain or one of its addresses has dropped off a trust list (such as DNSWL) that it was previously on.

Domain control and lifecycle

• Registrar transfer-lock removed (warning): the transfer-lock on a domain has been taken off. If you did not start a transfer yourself, this can be an early warning sign of a hijack, so it is worth contacting your registrar.
• Registrar lock changed (info): the registrar-lock setting on a domain has changed.
• Parked domain reactivated (info): a domain on a Parked licence has gained mail records or a sending SPF rule, so DMARCER has switched it to Standard. Its next renewal will be billed at the Standard rate.

Brand and transfers

• Brand domain available (warning): a domain you are keeping an eye on in Brand Watch has become available to register.
• Incoming domain transfer (info): a partner has invited domains into your account for you to accept or decline.
• Domain transfer expired (warning): an outgoing transfer was not accepted within its 14-day window, so the domain stays on your account.

Managing your alerts

Use Alert Settings to choose which alert types you receive and whether they go to the notification centre, your email, or both. MSPs can send alerts to a connected PSA so they become tickets automatically. Every alert is also saved in the notification centre, so nothing slips through the cracks.