---
title: Data-breach and blacklist monitoring
description: Learning that your mail server is on a blacklist from a bounced customer email is a bad way to learn it. You can now watch for credential breaches and for…
canonical: https://watchfor.io/changelog/2026-05-11-breach-blacklist-monitoring
---

[All updates](/changelog/page/9#2026-05-11-breach-blacklist-monitoring) ✨ New May 11, 2026 · v 1.6.1

# Data-breach and blacklist monitoring

Learning that your mail server is on a blacklist from a bounced customer email is a bad way to learn it. You can now watch for credential breaches and for email or IP blacklisting (RBL). Alerts fire on new findings only, so a listing you already know about does not page you again on every check.

Known breaches for the domain, with the date each was published.

Each blocklist's verdict, with its lookup time.

## Data breach

Watches the public Have I Been Pwned catalog for breaches that involve your domain, and lists each one with its breach date and the date it was published.

- New Breach Within Window is on and critical: it fires when a breach naming your domain was added in the last 48 hours. Old breaches stay on the list but don't page you on every check.

## Blacklist (RBL)

Checks whether your mail server's IP or your domain is on the DNS blocklists that mail providers consult before accepting mail. A day after launch it gained the details that make it useful:

- a built-in list (Spamhaus ZEN, Barracuda, SpamCop and SORBS) plus any zones you add, one per line;

- each list's verdict, with failed lookups reported as failed, not as listings;

- Listed on Any RBL (on, critical), Listed on Multiple RBLs and High RBL Failure Rate .

## Example

A compromised account sends spam from your outbound mail IP overnight, and on Monday morning Spamhaus lists it. Once the listing is confirmed, the blacklist monitor opens a critical incident, and you can request removal before customers start asking why your invoices bounce.

See [Security monitors](/docs/monitors/security). Today there is also a free [blacklist checker](/blacklist-checker) for one-off checks.

Share this update

---

Canonical page: https://watchfor.io/changelog/2026-05-11-breach-blacklist-monitoring · Site guide: https://watchfor.io/llms.txt