Building a custom alert when a domain trust score drops sharply
Email security teams in Australia deal with a steady drumbeat of phishing attempts, business email compromise scams, and impersonation campaigns hitting inboxes from Sydney to Perth. A drop in a trusted domain's reputation score often signals that something subtle has changed behind the scenes: a DKIM key rotation that broke, a DMARC policy that was relaxed, or a sudden burst of outbound mail from a compromised account in Melbourne or Brisbane.
Trust scores move because they reflect real authentication behaviour. When a sender that has historically aligned with SPF, DKIM, and DMARC suddenly starts failing one of those checks, the score responds. A swing of more than 20 points in a single day is rarely background noise; it usually means a configuration has slipped, a third-party sender has been added without proper setup, or an attacker is actively testing the domain.
For security leads at Australian businesses, catching that movement early matters. The Notifiable Data Breaches scheme and ACSC guidance both encourage proactive monitoring, and a custom alerting rule gives teams a head start before customers, partners, or regulators notice something has gone wrong.
The Trusted Sender Score platform exposes an API that returns current reputation data for any domain. By polling that endpoint on a schedule and comparing the latest reading to the previous day's result, a small piece of logic can flag exactly the kind of sudden decline that warrants investigation.
What makes a trust score move
A sender score is built from several inputs: authentication pass rates, spam trap hits, sending volume consistency, and historical reputation across major mailbox providers. When any of these inputs shift, the composite number moves with them.
A 20-point drop in 24 hours is significant because most legitimate changes happen gradually. A new marketing platform being onboarded in Adelaide might cause a slow drift over a week, but a sudden cliff usually points to a misconfiguration or hostile activity, such as a spoofing attempt where attackers are sending mail that fails DKIM verification.
Tracking the underlying signals alongside the headline score helps teams understand whether a drop is recoverable in hours or likely to require a longer remediation effort.
Picking the right monitoring cadence
How often a rule fires depends on the volume of mail a domain handles. A small Australian retailer sending a few campaigns a week does not need the same polling frequency as a financial services firm in the Sydney CBD moving tens of thousands of transactional messages daily.
For low-volume senders, checking once per hour is plenty. For high-volume senders, polling every fifteen minutes catches fast-moving problems before they cascade. The platform's API is rate-limited, so the cadence needs to fit comfortably inside those limits without risking throttling.
Storing the previous reading locally is what makes the comparison possible. A lightweight database or even a flat file holding the last known score for each monitored domain is enough to drive the rule.
Defining the threshold and notification path
| Channel | Best suited for | Latency | Setup complexity |
|---|---|---|---|
| After-hours teams, compliance log | 1–5 min | Low | |
| Slack or Teams | SOC desks, collaborative triage | Seconds | Medium |
| SMS | On-call responders, critical domains | Seconds | High |
| Webhook | Ticketing systems, SOAR playbooks | Seconds | Medium |
A 20-point drop in a 24-hour window is the trigger condition. Some teams also want a secondary rule that fires on a smaller drop if it persists across two days, which can catch slow leaks that a single-day threshold would miss.
Choosing where the alert lands matters as much as the rule itself. An SMS for a finance team's transactional domain in Sydney will get a faster response than an email buried in a shared inbox, while a webhook feeding ServiceNow or Jira works well for organisations with mature incident workflows operating across AEST time zones.
Writing the rule logic
The core of the rule is simple: fetch the current score, fetch the previous score, subtract, and compare against the threshold. Most teams wrap this in a scheduled script that runs continuously through the business day.
current = api.get_score(domain)
previous = stored_scores.get(domain)
delta = current - previous
if delta < -20:
notify(team, domain, delta)
log_event(domain, delta)
Practical touches reduce noise. Filtering out domains currently in a planned migration, suppressing repeat alerts within a six-hour window, and tagging the alert with the domain owner all make responses faster. Operators who want a quick primer on assessing unfamiliar senders can use a risk assessment guide to shape what the alert should include.
Testing before production
No alerting rule should hit production without a soak test. Replaying historical score data against the logic shows whether the threshold is too sensitive or too lenient. A good first run surfaces false positives from domains undergoing legitimate platform migrations, after which the team can whitelist those senders.
Pairing the rule with periodic spot-checks of the underlying DKIM and DMARC posture keeps the alert from becoming the only line of defence. The legal and acceptable use boundaries of the platform are spelled out on the terms of use page, which is worth a read before scaling polling across an entire portfolio.
Responding to alerts over time
A custom rule is not a one-off project. Scores trend, sending patterns evolve, and Australian businesses regularly onboard new SaaS platforms that touch their domains. Reviewing alert history each quarter keeps the threshold aligned with the current risk profile.
Teams that document every alert, including the ones that turned out to be benign, build a feedback loop that sharpens future responses. Over a year, the pattern often reveals which senders are chronically noisy and which deserve permanent watch status.