This document explains the alert function of CMC Domain Protection, including how to set it up and the notification mechanism.
By using the alert function, you can automatically detect significant changes in DMARC operation, such as the appearance of new email sending domains, unintended changes to DNS records, or a sudden drop in the DMARC authentication success rate, and receive notifications via email. This allows you to quickly notice security risks and misconfigurations without having to check the management screen every day.
Alert Feature Overview
From the "Alert Settings" screen in the management console, you can create and manage monitoring conditions (alerts) as well as review the detection history. This feature consists of two tabs: "Alert List" and "Alert Log."
■ Alert List
This tab allows you to review and edit currently configured alerts. To add a new alert, click the "Create Alert" button within this tab.
You can configure the following three types of alerts:
New Domain Detection: Detects the header From domain that sent an email for the first time under the organization's domain.
DNS: Monitors for changes or syntax errors in DMARC/SPF records.
DMARC Authentication Rate: Notifies you when the DMARC success rate or failure rate exceeds (or falls below) the set threshold.
■ Alert Log
This tab allows you to review and manage the history (logs) of alerts that have been detected so far.
Search / Filter: You can search for logs within a specific period by specifying the start and end dates.
Download: You can download the displayed alert log data in formats such as CSV.
Create Alert
The steps to create a new alert are as follows:
Click the "Alert Setting" tab.
Click the "Create Alert" button.
The "Create Alert Settings" window will be displayed.
1.General Settings
Enter the basic information common to all alert types.
Item | Description |
|---|---|
Enable | Toggle the alert on or off. (Default: Enabled) |
Alert Name | Enter a name for the alert. (Required, up to 50 characters) |
Alert Recipient | Enter the email address to receive notifications. (Required, limited to one email address only) |
2.Settings by Monitoring Type
Switch tabs according to the content you want to monitor to configure detailed settings.
【New Domain Detection】
Item | Description |
|---|---|
Target Organizational Domain | Select the target organization domain to be monitored from the drop-down menu. |
Monitoring mechanism: Detects the first appearance of a header "From" domain. The check is performed daily at 8:00 AM (JST).
【DNS】
Regularly checks DNS records (DMARC/SPF) to detect changes or configuration errors in target domains.
Item | Description |
|---|---|
Target Domain | Enter or select the domain to be monitored. Subdomains can also be specified. |
Record Type | Select either "DMARC" or "SPF." |
Condition | DNS Change Check: Detects changes based on the DNS value at the time of alert creation (or enabling).Syntax Check: Checks for any syntax errors within the DNS record. |
Monitoring mechanism: DNS queries are executed daily at 8:00 AM (JST).
Why the aggregation target is set to "3 days ago":
Report delivery frequencies and timings vary by ISP, causing a time lag before all data is completely gathered. We target data from three days ago to ensure we are processing a finalized and accurate dataset.
【DMARC Authentication Rate】
Monitors DMARC authentication results (success rate/failure rate) for abnormal changes.
Item | Description |
|---|---|
Target Domain | Select the domain to be monitored (either an Organizational Domain or a Header From Domain). |
Target Domain Scope | Choose whether to set the aggregation scope to the entire Organizational Domain or a specific Header From Domain.Note: A domain cannot be targeted as a "Header From Domain" if it has no record of email delivery (i.e., it has not been captured in any DMARC reports). |
Type | Select a metric to monitor from the following options: |
Threshold (Percentage) | Enter the percentage to be used as the evaluation criteria (up to two decimal places). |
Condition | Select whether the alert should be triggered when the value is "Greater than" or "Less than" the specified threshold. |
Monitoring Mechanism: Every day at 8:00 AM (JST), the system aggregates and evaluates data for the entire day (00:00–23:59) from three days prior.
Managing Alerts
You can check and manage created alerts on the alert settings screen.
Edit: Click the edit button (pencil icon) in the list to change the settings.
Delete: Check the alert you want to delete, select "Delete" from the Bulk Actions menu, and execute.
Enable/Disable: If you want to temporarily stop monitoring, select the alert using the checkbox and execute "Disable" (or "Enable") from the Bulk Actions menu.
Status Check: You can check whether the current status is "Normal" or "Alert (Detecting)”.
Disabling or re-enabling a 'DNS Change Check' alert resets the reference DNS value.
The current DNS record at the time of reactivation will be captured as the new baseline.
About Notification Emails
If the monitoring conditions are met, a notification will be sent via email to the configured "Alert Recipient."
• Detection Notification: Sent when an anomaly or change is detected. The detected content (e.g., new domain name, DNS values before and after change, actual measured values) is included.
Recovery Notification: For the "DMARC Authentication Rate" alert, a recovery notification is sent when the numerical value returns to the normal range. (Note: Recovery notifications are not available for new domain detection and DNS monitoring)
Alert Types and Use Cases
The types and uses of alerts are as follows.
Alert Types | Use Cases | Monitoring Schedule | Recovery Notification |
|---|---|---|---|
New Domain Detection | Identify unauthorized email sending from unknown domains and early signs of emerging spoofing attacks. | Daily | None |
DNS | Detect accidental DNS record changes, syntax errors (typos), and malicious tampering. | Daily | None |
DMARC Authentication Rate | Identify sudden drops in success rates or spikes in failure rates to uncover large-scale attacks or configuration issues in legitimate emails. | Daily (References data from 3 days prior to execution) | Available |
Checking Alert Logs
The history of alert detections and recoveries is recorded as alert logs, which can be reviewed and downloaded from the "Alert Log" tab.
1. Viewing and Searching Alert Logs
Click the "Alert Log" tab at the top of the "Alert Settings" screen to display a list of the alert log history.
Search / Filter: You can filter the alert logs generated within a specific period by specifying a "Start Date" and "End Date" using the calendar at the top of the screen, and then clicking the "Search" button.
2. Displayed Items
The alert log list allows you to review the following details at the time of detection:
Detection Date/Time
Alert Name
Target Domain
Status (Alert or Recovered)
Type
Condition
Threshold
Actual Value
Notification Destination
3. Downloading Alert Logs
Click the "Download" button at the top right of the screen to bulk-download the currently searched and displayed alert log history as a CSV file (compressed in a ZIP format).
In addition to the items displayed on the screen, the downloaded CSV file includes the following additional fields for deeper analysis:
Domain Range: The scope of the domain (e.g., Organizational Domain, Header From Domain)
DNS Value: The DNS value at the time the alert was configured
Setting Date: The date and time when the alert was configured
Please utilize this data for your own detailed analysis or for keeping audit logs on hand.
[Important] Alert Log Retention Period
The retention period for alert logs is 90 days, and this period cannot be
changed. If you need to keep logs for a long period or for auditing
purposes, please make sure to periodically use the download feature to
save the data locally before it is automatically deleted.
Notes
About Recovery Logs: When "New Domain Detection" or "DNS Detection
Settings" return to a normal state, no recovery logs are recorded. Logs with
a "Recovered" status are only recorded for "DMARC Authentication Rate"
alerts.
About Log Retention Upon Deletion: Even if you delete an existing alert
configuration from the Alert Settings list, the history of previously detected
alert logs will be retained and will not be deleted.
