---
title: Email notifications in WatchFor
description: Alert emails — who receives them, what they look like, the sender to allow-list, and the built-in default channel.
canonical: https://watchfor.io/docs/notifications/email
---

# Email notifications in WatchFor

Alert emails — who receives them, what they look like, the sender to allow-list, and the built-in default channel.

Email is the channel every organization starts with and the one that needs no
setup on the other side. Alert emails are HTML, self-contained (diagnosis,
expected vs detected, confirming locations, a **View Incident Details**
button) and come from a fixed sender you can allow-list.

## Sender

All alert emails are sent as **WatchFor Alert `<noreply@watchfor.io>`**.
Replies are not read. If your mail system filters aggressively, allow-list
that address — a filtered *DOWN* email is the most common reason "we never got
the alert".

Account emails (sign-in, invitations, reports) use a different sender; alerts
always come from `noreply@`.

## Recipients come from contact groups

An email channel has no address field of its own. When you add one under
**Alerting → Channels & contacts → Add Channel → Email** you tick one or more
[contact groups](/docs/notifications/contact-groups). Every alert is
addressed to the **current members** of those groups, de-duplicated, at the
moment it is sent. The form's **Recipients (N)** preview and the channel
list's recipient count both show that live membership.

> **Group changes apply immediately**
>
> Adding a contact to a group, removing one, or changing a contact's email
> address takes effect on the next alert — there is nothing to re-save on
> the channel. The channel also keeps a copy of the recipient list from the
> last time it was saved; that copy is used only as a fallback if group
> membership can't be read when an alert goes out, and it is refreshed
> whenever you save the channel or delete one of its groups.

You can create **several email channels** — for example one attached to the
*Web team* group and one to the *Mail admins* group — each with its own
severity filter.

## The default email channel

Signing up creates **Default Email — *your organization***, routed through
your default contact group to the owner's (already verified) address. It is
flagged **Default**, can't be deleted until another channel is promoted
(**⋯ → Set as default**), and can be disabled, edited or re-routed like any
other channel. See [the default channel](/docs/notifications#the-default-channel).

## What an alert email looks like

- **Subject** is the standard title: `🔴 DOWN: API (prod)`,
  `🟡 Degraded: …`, `🟢 UP: …` or `⏹️ Resolved: …` for an administrative
  close.
- A colored status banner (red critical, amber warning, green recovered,
  gray administrative) followed by the monitor (linked), the checked URL and —
  on recovery — the incident duration.
- **Root Cause Analysis**: the diagnosis, **Expected**, **Detected** (or *Was
  Detected* / *Now Returning* on recovery), and both rule versions if the
  rule changed during the incident.
- Certificate details for SSL incidents (subject, issuer, protocol, validity,
  days until expiry, SANs, serial).
- Severity, start/resolve times (UTC), the locations that **confirmed** the
  failure, a flapping warning when applicable, and a **View Incident Details**
  button.

Several incidents landing within the [grouping window](/docs/notifications#grouping-during-a-storm)
arrive as one digest — subject `🔴 3 new incidents` (or `🟢 2 recovered`)
with one linked line per incident.

## Testing

**⋯ → Send test** on the channel sends an email with the subject prefixed
`[TEST]` and an amber banner stating that it is a simulation. If it doesn't
arrive, check spam/quarantine for `noreply@watchfor.io` before anything else,
then confirm the channel is **Enabled** and that its groups contain the
contacts you expect (the **Recipients** preview in **⋯ → Edit** shows
exactly who will be addressed).

## Also via API

Contacts and contact groups — and therefore who receives email — can be
managed through the [REST API](/docs/api/contacts), the MCP server and A2A.

---

Canonical page: https://watchfor.io/docs/notifications/email · All docs: https://watchfor.io/docs · Site guide: https://watchfor.io/llms.txt