# Monitoring notifications and incidents

> Where domain alerts go, how to connect email, Telegram or a webhook, set quiet hours, and what to do when an incident is opened.

URL: https://zrazu.com/en/docs/monitoring-alerts/

When [monitoring](https://zrazu.com/en/docs/monitoring-checks.md) confirms a problem, an **incident** opens and you get a notification. When everything is back, we write about that too: "resolved, lasted so many minutes".

## Notification channels

Set them up in the [cabinet](https://vse.zrazu.com/settings/notifications/), on the "Notifications" page.

| Channel | How to connect |
| --- | --- |
| Email | Enter the address in "Notification email" and click "Add" |
| Telegram | Click "Link Telegram", then "Open in Telegram" |
| Webhook | Add an address: https only, port 443, not an internal network, up to three per organization |

For a webhook we show the **signing secret** once. Save it right away, it will not be shown again. Every request is signed with a header, so check the signature before trusting the request body. Do not share the secret with anyone.

The Telegram link is valid for 15 minutes. If Telegram does not deliver a message, we duplicate it by email.

## What to send

The table on this page has categories: "Terms", "Health", "Changes and plans", "Money", "Monthly report". Choose channels for each. Critical alerts cannot be switched off.

## Quiet hours

In "Quiet hours" enter a range like `22:00-08:00` and click "Save". During that time ordinary messages wait for the morning digest. Critical alerts always come through: domain switched off, zone not responding, domain being moved away, term expired, DNSSEC problems.

## Incidents

All incidents are in "Monitoring → Incidents". An incident card shows:

- the state, "ongoing" or "resolved", and the importance: "minor", "important", "critical";
- the "Domains" affected. When several domains break for one reason, we merge them into one incident;
- "Checked from several vantage points": where the problem was seen from;
- "How we notified": channel and delivery status;
- "Timeline".

## What you can do

1. Open the incident from the message or from the list.
2. "Snooze for an hour": we remind you if it has not recovered.
3. "This is expected, don't bother me for a day": for example, you changed the settings yourself.
4. If the cause is a recent DNS change, click "Roll back the change". You can undo it within 60 seconds.
5. Mark whether the alert was accurate ("Yes, it was real" or "No, false alarm").

## If it didn't work

- **Emails do not arrive.** Next to the address it says "This mailbox is not accepting mail". Enter another address.
- **Telegram does not link.** The link is valid for 15 minutes, create a new one.
- **The webhook is not added.** Check that the address is https, port 443, does not lead to an internal network, and that you have no more than three.
- **The change cannot be rolled back.** The zone was changed again after it. Roll back the needed revision in the domain's DNS history.
- **"Critical cannot be switched off".** This is a deliberate limit.