---
title: Email monitoring with WatchFor
description: Monitor mail servers (connection, STARTTLS, open relay, reverse DNS, authenticated sending) and your email authentication policy — SPF, DMARC and DKIM records — plus pointers to IMAP, POP3 and email round-trip monitoring.
canonical: https://watchfor.io/docs/monitors/email
---

# Email monitoring with WatchFor

Monitor mail servers (connection, STARTTLS, open relay, reverse DNS, authenticated sending) and your email authentication policy — SPF, DMARC and DKIM records — plus pointers to IMAP, POP3 and email round-trip monitoring.

Email problems are quiet — messages just stop arriving. These monitors watch
both the **server** that sends or receives mail and the **policy** that decides
whether your mail is trusted.

Three more email types have their own pages:

- **[IMAP](/docs/monitors/imap)** and **[POP3](/docs/monitors/pop3)** — the
  servers people and systems read mail from: TLS and certificate, login,
  mailbox counts and the age of the newest message, with a mail server grade.
- **[Email round-trip](/docs/monitors/email-round-trip)** — sends a test
  message through your SMTP server, finds it in a mailbox and reports the
  delivery time, inbox or spam, SPF/DKIM/DMARC results and every relay hop.

## SMTP

Connects to a mail server and verifies that it is healthy and well-behaved:
connection and banner timing, `EHLO`, STARTTLS support, an **open-relay
test**, and forward-confirmed reverse DNS (PTR) for the server's address.

**Target:** the mail server's host name only (for example `mail.example.com`,
not the bare domain: MX records are not looked up). Pick the port under
**Port & encryption**. If you type a port into the target
(`smtp.example.com:587`), the dashboard moves it to **Port & encryption** for
you; the API refuses it, so set `config.port` instead.

| Setting | Notes |
| --- | --- |
| **Port & encryption** | **25** (plain SMTP, STARTTLS if offered), **465** (SMTPS, implicit TLS), **587** (submission, STARTTLS) or a custom port. |
| **Authenticate (submission)** | Off by default. On logs in the way a mail client does, to check that a sending account still works — see [Authenticated submission](#authenticated-submission). |
| **Timeout** and **IP version** | Seconds (default 10); Auto / IPv4 / IPv6. |

| Preset | Default | Fires when |
| --- | --- | --- |
| **Probe Status** | on | The server doesn't accept connections. |
| **Open Relay Detected** | on (critical) | The server is willing to relay mail for anyone — a serious misconfiguration. Opens on the first observation. |
| **SMTP Connect Time** | off | Connecting takes longer than the threshold. |
| **TLS Required** | off | The server doesn't offer STARTTLS. |
| **FCrDNS / PTR Failed** | off | The server's IP has no valid reverse DNS matching its forward name — a common cause of rejected mail. |
| **Banner Hostname Mismatch** | off | The hostname in the SMTP greeting differs from the monitored target — catches drift after rebuilds. MX clusters commonly answer with a shared banner name (`mx.google.com` for a `gmail-smtp-in.l.google.com` target), so this fires on many healthy targets; enable it only for servers you run where the banner must match. |
| **Login Failed** | on when Authenticate is set (critical) | The server refuses the submission login. |
| **Certificate Expiry** | on when Authenticate is set (warning) | The certificate served for TLS has fewer than 14 days left. |

### Authenticated submission

Your apps, shop and mail clients send through a submission login, and that
login breaks in ways a banner check can't see: a rotated password, a disabled
account, a provider that switched off password logins, a certificate that
expired on port 587. Turn on **Authenticate (submission)** to check it.

| Setting | Notes |
| --- | --- |
| **Encryption** | **STARTTLS** (port 587, the default) or **Implicit TLS** (port 465). Port 25 is never used for authenticated checks: it is meant for server-to-server mail, and cloud networks block it outbound. |
| **Username** and **Password** | The sending login. The password is stored encrypted (AES-256-GCM, bound to this monitor) and never shown again: API and MCP responses return it as `"[redacted]"`, and it never appears in results, errors, logs, exports or the activity log. Turning Authenticate off deletes it. |
| **Verify certificate** | On by default: an expired, self-signed or mismatched certificate fails the check. |

With a login, each check connects, reads the banner, sends `EHLO` and
completes TLS — from the first byte on 465, or by performing the STARTTLS
upgrade on 587 rather than only noting that it is offered. It then reads the
certificate, lists the offered authentication methods, logs in with
`AUTH PLAIN` or `AUTH LOGIN` and ends with `QUIT`. No message is sent, and
the open-relay test is skipped for this kind of check (the reverse DNS check
still runs when it is on). The
password is only sent after TLS: if a STARTTLS server stops offering the
upgrade, the check fails without sending it.

The certificate also feeds the mail server grade (A+ to F) on the monitor
page, graded the same way as for [IMAP](/docs/monitors/imap#mail-server-grade).

Gmail needs an [app password](https://support.google.com/accounts/answer/185833);
Microsoft 365 is retiring password (basic) logins for SMTP AUTH, and
WatchFor doesn't support OAuth sign-in yet.

Metrics for custom rules: `smtp.auth_ok` (`1` login accepted, `0` refused),
`smtp.auth_ms`, `smtp.tls_version`, `smtp.tls_time_ms`,
`smtp.cert_days_left` and `smtp.cert_valid`, in addition to the connect,
banner and `EHLO` timings.

To test that a message you send actually arrives — and whether it lands in
the inbox or spam — use an [email round-trip](/docs/monitors/email-round-trip)
monitor.

## Email policy (SPF / DMARC / DKIM)

Checks the DNS records that protect your domain from spoofing and keep your
mail out of spam:

- **SPF** — which servers may send for your domain. Also validates the
  record and estimates the DNS-lookup count (the RFC limit is 10). The
  estimate counts the record's own lookup terms; lookups nested inside
  `include:` targets aren't added, so a record can fail at receivers before
  the count reaches 10.
- **DMARC** — what receivers should do with mail that fails checks
  (`p=none`, `quarantine` or `reject`), the subdomain policy, percentage and
  reporting addresses.
- **DKIM** — cryptographic signing of your messages, checked per selector.

The verdict is shown in plain language, with the specific record that is
missing or weak.

**Target:** the domain, e.g. `example.com`.

| Setting | Notes |
| --- | --- |
| **Check SPF / DMARC / DKIM** | Toggle each check. |
| **DKIM Selectors** | Comma-separated selectors to look up, e.g. `default, google, selector1, selector2`. DKIM can't be checked without them — the selector is part of the record name. |
| **Response Timeout** | Seconds to wait for the DNS lookups (the shared timeout slider). |

| Preset | Default | Fires when |
| --- | --- | --- |
| **Probe Status** | on | The lookups could not run. |
| **SPF Record Missing** | on (critical) | No SPF record is published. |
| **DMARC Record Missing** | on (critical) | No DMARC record is published. |
| **SPF Too Many DNS Lookups** | off | The SPF record's own lookup terms add up to more than 10 (nested includes aren't counted). |
| **Weak DMARC Policy** | off | The policy is `p=none` (monitoring only). Off by default: `p=none` is a valid stance while you roll DMARC out, so it is a choice, not a misconfiguration. |
| **DKIM Record Missing** | off | None of the configured selectors resolves to a DKIM key record. |

Free tools: [SPF record checker](/spf-record-checker),
[DMARC record checker](/dmarc-record-checker),
[DKIM record checker](/dkim-record-checker),
[email policy checker](/email-policy-checker) and the
[SPF / DMARC generator](/spf-dmarc-generator). For blacklist (RBL) listings
of your mail server, see [Security](/docs/monitors/security#blacklist-rbl).

## Also via API

Create with `type: "smtp"` (config: `port`; for authenticated submission
also `username`, `password`, `tlsMode`, `verifyTls`) or `type: "email_policy"`
(config: `checkSpf`, `checkDmarc`, `checkDkim`, `dkimSelectors`) — see the
type catalog for [SMTP](/docs/api/monitor-types#smtp) and
[Email Security](/docs/api/monitor-types#email-security). IMAP, POP3 and
email round-trip have their own pages: [IMAP](/docs/monitors/imap#also-via-api),
[POP3](/docs/monitors/pop3#also-via-api) and
[email round-trip](/docs/monitors/email-round-trip#also-via-api).

---

Canonical page: https://watchfor.io/docs/monitors/email · All docs: https://watchfor.io/docs · Site guide: https://watchfor.io/llms.txt