---
title: Security
description: Watch for blacklist (RBL) listings of your mail server IP or domain, and for newly published data breaches involving your domain.
canonical: https://watchfor.io/docs/monitors/security
---

# Security

Watch for blacklist (RBL) listings of your mail server IP or domain, and for newly published data breaches involving your domain.

These monitors watch your reputation and exposure — things that don't show up
in an uptime check but can quietly damage deliverability and trust. Both are
slow-moving, rate-limited lookups, so they skip the accelerated multi-location
confirmation other types use and alert on their own rule thresholds.

## Blacklist (RBL)

Checks whether your **mail server IP or domain** appears on DNS-based
blocklists (RBLs) that mail providers consult before accepting mail.

**Target:** a domain or IP address.

| Setting | Notes |
| --- | --- |
| **RBL list** | One zone per line. Leave empty for the built-in list — `zen.spamhaus.org`, `b.barracudacentral.org`, `bl.spamcop.net` and `dnsbl.sorbs.net` — or add the lists that matter to you (lines starting with `#` are ignored). |
| **Custom Resolver** | Query a specific DNS server (`ip:port`). Some RBLs rate-limit or block public resolvers, so a dedicated resolver gives more reliable answers. |
| **Timeout** | Seconds (default 10). |

The Overview shows a **providers table** with each blocklist's verdict, and
how many lookups failed (a failed lookup is not a listing).

| Preset | Default | Fires when |
| --- | --- | --- |
| **Probe Status** | on | The lookups could not run. |
| **Listed on Any RBL** | on (critical) | At least one blocklist lists the target. |
| **Listed on Multiple RBLs** | off | *N* or more blocklists list the target (default 2). |
| **High RBL Failure Rate** | off | Two or more lookups failed — usually the resolver being blocked by the RBL. |

**Listed on Any RBL** and **Listed on Multiple RBLs** are two independent
rules on the same listing count (`> 0` and `≥ N`); toggling or editing one
never changes the other, and you can run both — a critical page on the
first listing and a second signal once several lists agree.

> **Info**
>
> Getting blacklisted can silently kill email deliverability long before you
> notice bounced messages. This monitor turns that into an alert you can act
> on. Free one-off check: [blacklist checker](/blacklist-checker).

## Data breach

Watches whether your **domain** appears in a **known data breach**, using the
public Have I Been Pwned breach catalog, and surfaces **new** findings so you
can act.

**Target:** your website URL; the domain is taken from it.

- A **list of known breaches** naming the domain, with the breach date and
  the date each was added to the catalog.
- Counts of total and recent breaches.

| Preset | Default | Fires when |
| --- | --- | --- |
| **New Breach Within Window** | on (critical, 48 hours) | A breach was added to the catalog within the last *N* hours — so you are alerted to fresh exposure, not old history. Opens on the first observation. |

The generic **Probe Status** rule is off by default for this type: a
temporarily unreachable breach catalog is not a problem with your domain.
Turn it on only if you want to hear about lookup failures.

## Also via API

Create with `type: "blacklist"` (config: `rblsText`, `resolver`) or
`type: "breach"` — see the type catalog for
[Blacklist (RBL)](/docs/api/monitor-types#blacklist-rbl) and
[Breach](/docs/api/monitor-types#breach).

---

Canonical page: https://watchfor.io/docs/monitors/security · All docs: https://watchfor.io/docs · Site guide: https://watchfor.io/llms.txt