---
title: Security monitoring (blacklists and breaches) in WatchFor
description: Watch for blacklist (RBL) listings of your mail server's IP address, and for newly published data breaches involving your domain.
canonical: https://watchfor.io/docs/monitors/security
---

# Security monitoring (blacklists and breaches) in WatchFor

Watch for blacklist (RBL) listings of your mail server's IP address, and for newly published data breaches involving your domain.

These monitors watch your reputation and exposure — things that don't show up
in an uptime check but can quietly damage deliverability and trust. Both are
slow-moving, rate-limited lookups, so they skip the accelerated multi-location
confirmation other types use and alert on their own rule thresholds.

## Blacklist (RBL)

Checks whether your **mail server's IP address** appears on DNS-based
blocklists (RBLs) that mail providers consult before accepting mail.

**Target:** an IPv4 address, or a host name that resolves to one. A host name
is resolved and its first address is looked up, so use the mail server's host
name rather than a bare domain that points at your website. Lists are queried
with a reverse-IP lookup; domain blocklists (such as Spamhaus DBL) and IPv6
aren't supported.

| Setting | Notes |
| --- | --- |
| **RBL list** | One zone per line. Leave empty for the built-in list — `zen.spamhaus.org`, `b.barracudacentral.org` and `bl.spamcop.net` — or add the lists that matter to you (lines starting with `#` are ignored). |
| **Custom resolver** | Query a specific DNS server (`ip:port`). Some RBLs rate-limit or block public resolvers, so a dedicated resolver gives more reliable answers. |
| **Timeout** | Seconds (default 10). |

The Overview shows a **providers table** with each blocklist's verdict, and
how many lookups failed (a failed lookup is not a listing).

| Preset | Default | Fires when |
| --- | --- | --- |
| **Probe Status** | on | The lookups could not run. |
| **Listed on Any RBL** | on (critical) | At least one blocklist lists the target. |
| **Listed on Multiple RBLs** | off | *N* or more blocklists list the target (default 2). |
| **High RBL Failure Rate** | off | Two or more lookups failed — usually the resolver being blocked by the RBL. |

**Listed on Any RBL** and **Listed on Multiple RBLs** are two independent
rules on the same listing count (`> 0` and `≥ N`); toggling or editing one
never changes the other, and you can run both — a critical page on the
first listing and a second signal once several lists agree.

> **Info**
>
> Getting blacklisted can silently kill email deliverability long before you
> notice bounced messages. This monitor turns that into an alert you can act
> on. Free one-off check: [blacklist checker](/blacklist-checker).

## Data breach

Watches whether your **domain** appears in a **known data breach**, using the
public Have I Been Pwned breach catalog, and surfaces **new** findings so you
can act.

**Target:** the domain, e.g. `example.com` (a website URL works too; only its
host name is used).

A breach monitor checks from **one location per check**, taking turns (round
robin): every location reads the same public catalog, so asking from several
at once would only repeat the same answer.

- A **list of known breaches** naming the domain, with the breach date and
  the date each was added to the catalog.
- Counts of total and recent breaches.

| Preset | Default | Fires when |
| --- | --- | --- |
| **New Breach Within Window** | on (critical, 48 hours) | A breach was added to the catalog within the last *N* hours — so you are alerted to fresh exposure, not old history. Opens on the first observation. |

The generic **Probe Status** rule is off by default for this type: a
temporarily unreachable breach catalog is not a problem with your domain.
Turn it on only if you want to hear about lookup failures.

## Also via API

Create with `type: "blacklist"` (config: `rblsText`, `resolver`) or
`type: "breach"` — see the type catalog for
[Blacklist (RBL)](/docs/api/monitor-types#blacklist-rbl) and
[Breach](/docs/api/monitor-types#breach).

---

Canonical page: https://watchfor.io/docs/monitors/security · All docs: https://watchfor.io/docs · Site guide: https://watchfor.io/llms.txt