---
title: Email monitoring with WatchFor
description: Monitor mail servers (connection, STARTTLS, open relay, reverse DNS) and your email authentication policy — SPF, DMARC and DKIM records.
canonical: https://watchfor.io/docs/monitors/email
---

# Email monitoring with WatchFor

Monitor mail servers (connection, STARTTLS, open relay, reverse DNS) and your email authentication policy — SPF, DMARC and DKIM records.

Email problems are quiet — messages just stop arriving. These monitors watch
both the **server** that sends or receives mail and the **policy** that decides
whether your mail is trusted.

## SMTP

Connects to a mail server and verifies that it is healthy and well-behaved:
connection and banner timing, `EHLO`, STARTTLS support, an **open-relay
test**, and forward-confirmed reverse DNS (PTR) for the server's address.

**Target:** a domain (the MX records are looked up automatically) or
`host:port` for a specific server.

| Setting | Notes |
| --- | --- |
| **Port & Encryption** | **25** (plain SMTP, STARTTLS if offered), **465** (SMTPS, implicit TLS), **587** (submission, STARTTLS) or a custom port. |
| **Timeout** and **IP version** | Seconds (default 10); Auto / IPv4 / IPv6. |

| Preset | Default | Fires when |
| --- | --- | --- |
| **Probe Status** | on | The server doesn't accept connections. |
| **Open Relay Detected** | on (critical) | The server is willing to relay mail for anyone — a serious misconfiguration. Opens on the first observation. |
| **SMTP Connect Time** | off | Connecting takes longer than the threshold. |
| **TLS Required** | off | The server doesn't offer STARTTLS. |
| **FCrDNS / PTR Failed** | off | The server's IP has no valid reverse DNS matching its forward name — a common cause of rejected mail. |
| **Banner Hostname Mismatch** | off | The hostname in the SMTP greeting differs from the monitored target — catches drift after rebuilds. MX clusters commonly answer with a shared banner name (`mx.google.com` for a `gmail-smtp-in.l.google.com` target), so this fires on many healthy targets; enable it only for servers you run where the banner must match. |

## Email policy (SPF / DMARC / DKIM)

Checks the DNS records that protect your domain from spoofing and keep your
mail out of spam:

- **SPF** — which servers may send for your domain. Also validates the
  record and estimates the DNS-lookup count (the RFC limit is 10).
- **DMARC** — what receivers should do with mail that fails checks
  (`p=none`, `quarantine` or `reject`), the subdomain policy, percentage and
  reporting addresses.
- **DKIM** — cryptographic signing of your messages, checked per selector.

The verdict is shown in plain language, with the specific record that is
missing or weak.

**Target:** the domain, e.g. `example.com`.

| Setting | Notes |
| --- | --- |
| **Check SPF / DMARC / DKIM** | Toggle each check. |
| **DKIM Selectors** | Comma-separated selectors to look up, e.g. `default, google, selector1, selector2`. DKIM can't be checked without them — the selector is part of the record name. |
| **Response Timeout** | Seconds to wait for the DNS lookups (the shared timeout slider). |

| Preset | Default | Fires when |
| --- | --- | --- |
| **Probe Status** | on | The lookups could not run. |
| **SPF Record Missing** | on (critical) | No SPF record is published. |
| **DMARC Record Missing** | on (critical) | No DMARC record is published. |
| **SPF Too Many DNS Lookups** | off | The SPF record needs more than 10 lookups and will fail at receivers. |
| **Weak DMARC Policy** | off | The policy is `p=none` (monitoring only). Off by default: `p=none` is a valid stance while you roll DMARC out, so it is a choice, not a misconfiguration. |
| **DKIM Record Missing** | off | None of the configured selectors resolves to a `v=DKIM1` record. |

Free tools: [SPF record checker](/spf-record-checker),
[DMARC record checker](/dmarc-record-checker),
[DKIM record checker](/dkim-record-checker),
[email policy checker](/email-policy-checker) and the
[SPF / DMARC generator](/spf-dmarc-generator). For blacklist (RBL) listings
of your mail server, see [Security](/docs/monitors/security#blacklist-rbl).

## Also via API

Create with `type: "smtp"` (config: `port`) or `type: "email_policy"`
(config: `checkSpf`, `checkDmarc`, `checkDkim`, `dkimSelectors`) — see the
type catalog for [SMTP](/docs/api/monitor-types#smtp) and
[Email Security](/docs/api/monitor-types#email-security).

---

Canonical page: https://watchfor.io/docs/monitors/email · All docs: https://watchfor.io/docs · Site guide: https://watchfor.io/llms.txt