Which address do Shelltrap notifications come from?

Shelltrap notifications are sent from:

sentinel@shelltrap.com

That is the address on alert mail, digests and the answers you get to a false-positive report. Put it on the allowlist of whatever filters your mail before you go live — a security alert that lands in a spam folder is worse than no alert, because you believe you have one.

What to allowlist, and where

• Add sentinel@shelltrap.com to the allowlist or safe-sender list of your mail filter, and of the mailbox provider your admin address is hosted with.
• If you filter server-side with SpamAssassin, rspamd or a hosted gateway, add the address there too. A rule on the envelope sender is more robust than one on the display name.
• If your admin address is a ticket system or a group alias, check that the alias accepts external senders and does not silently drop attachments.
• Do not filter on the subject line only — subjects change as the product changes.

Where the alerts go

The recipients are configured on your own host. The [notify] section of /etc/shelltrap/shelltrap.toml holds the transport and the administrator recipients, and the notify.targets policy key decides per scope who is told and how:

shelltrap policy get global
shelltrap policy set domain 42 notify.targets=...

Customer notifications, where enabled, go through the CyberPanel contact address of the account. Webhooks are restricted to an allowlist of targets.

If mail does not arrive

1. Check health first: an optional notify target that is not configured shows as a not_configured sub-status and does not by itself make the whole status degraded, but a failing target appears as notify_target_unavailable.

   shelltrap health

2. Check the transport. If your policy really uses SMTP or webhook targets, the network drop-in has to be installed — the vendor unit restricts RestrictAddressFamilies to AF_UNIX on purpose:

   sudo install -d /etc/systemd/system/shelltrapd.service.d
   sudo install -m 0644 /usr/share/shelltrap/systemd/20-network-notify.conf.example \
     /etc/systemd/system/shelltrapd.service.d/20-network-notify.conf
   sudo systemctl daemon-reload
   sudo systemctl restart shelltrapd.service

3. Check the recipient side: allowlist, alias, attachment policy, greylisting.

Reporting a false positive

False-positive reports go to a different address, falsepositive@shelltrap.com, and must come from the e-mail address registered in your client area. The reply arrives from sentinel@shelltrap.com, usually within an hour.