Refusal Notifications

Find out when one of your aliases turns mail away, so you know when a retired address is still being used.

Why Use This Feature?

1. Alerts you when a disabled or expired alias still receives mail so you can tell whether someone legitimate is trying to reach you.
2. Shows which sender a sender rule refused so you can adjust an allow list that is too strict.
3. Stays quiet for random addresses on your domain so spam doesn't flood your phone.

Setup

Add one or more notifiers to the notifiers list. Each one is either an ntfy topic or a Reverse Proxy for ntfy context, the same two options Branded Short Links offers.

{
  "notifiers": [
    {
      "type": "ntfy",
      "name": "phone",
      "server": "https://ntfy.example.com",
      "topic": "mailmask",
      "token": "tk_yourtoken"
    },
    {
      "type": "ntfy-reverse-proxy",
      "name": "reverse-proxy",
      "url": "https://mailmask.ntfy.example.com",
      "token": "optional-context-token"
    }
  ]
}

You can also add notifiers from the mm Manage Notifiers menu or with mm notifier add-ntfy and mm notifier add-reverse-proxy. Deploy afterwards to apply them.

What Triggers a Notification

A notification is sent for every refusal of a known alias:

• The alias is disabled.
• The alias has expired.
• The sender matches a block list.
• The sender isn't on the allow list.

Mail to addresses that are not aliases never triggers a notification, whatever your unknown alias action is.

Notification Format

Every notifier receives the same title, Mailmask refused a message, with an email tag. An ntfy notifier publishes a JSON message to the topic, and an ntfy-reverse-proxy notifier posts plain text with Title, Tags, and Priority headers. The message looks like this:

Alias: [email protected]
From: [email protected]
Action: reject
Reason: Sender is blocked

Tokens are sent as an Authorization: Bearer header. The content of the refused message is never included.