It’s been a while, so I decided to test my canary tokens. Found out they are triggering but not sending email alerts. So, I created several new ones (web, excel, word, pdf, etc.) and linked them to a couple of emails (business and public). Some of the new tokens do trigger and can be seen in canary token history, but an email alert is not sent.
Has Canary Tokens removed email alerts? Am I missing a configuration?
In my case, canary token emails to hotmail or MS365 are not received. Canary token emails to gmail are received.
I’m guessing that MS365 thinks they are phishing or some other unwanted message and blocking them. Just a guess.
Looks like their SPF records are not correct. It looks like they are using googe apps for business for email, but their spf record is allowing mailgun and zen desk. If you are also on google mail, it’s probably not checking spf since the servers are internal. Obviously I don’t know which service they are using to send alerts. What do your logs show?
> canarytokens.org
Server: dns.google
Address: 8.8.8.8
Non-authoritative answer:
canarytokens.org text =
"v=spf1 include:mailgun.org include:mail.zendesk.com ~all"
> set type=mx
> canarytokens.org
Server: dns.google
Address: 8.8.8.8
Non-authoritative answer:
canarytokens.org MX preference = 1, mail exchanger = aspmx.l.google.com
canarytokens.org MX preference = 10, mail exchanger = alt3.aspmx.l.google.com
canarytokens.org MX preference = 10, mail exchanger = alt4.aspmx.l.google.com
canarytokens.org MX preference = 5, mail exchanger = alt1.aspmx.l.google.com
canarytokens.org MX preference = 5, mail exchanger = alt2.aspmx.l.google.com```