# Emails won't send on ban or alert (test emails work)

**URL:** <https://discourse.crowdsec.net/t/emails-wont-send-on-ban-or-alert-test-emails-work/2601>\
**Category:** crowdsec\
**Created:** [June 16, 2025, 9:47am UTC](https://discourse.crowdsec.net/t/emails-wont-send-on-ban-or-alert-test-emails-work/2601 "2025-06-16T09:47:09Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Zoltrix](https://avatars.discourse-cdn.com/v4/letter/z/a88e4f/32.png) [@Zoltrix](https://discourse.crowdsec.net/u/Zoltrix)\
**Post date:** [June 16, 2025, 9:47am UTC](https://discourse.crowdsec.net/t/emails-wont-send-on-ban-or-alert-test-emails-work/2601/1 "2025-06-16T09:47:09Z")

</div>

I’ve setup the email notification function.

I’ve confirmed the settings are correct as when using “ **cscli notifications test email\_default** ” I receive a test email.

I’ve have seen alerts and bans happen, but no emails. I did read somewhere that I need to add the following to the “ **/etc/crowdsec/notifications/email.yaml** ” file:

```auto
triggers:
  - alert
  - ban

```

But is that correct? I’ve also restarted the crowdsec service.

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [June 17, 2025, 7:50am UTC](https://discourse.crowdsec.net/t/emails-wont-send-on-ban-or-alert-test-emails-work/2601/2 "2025-06-17T07:50:06Z")

</div>

No there no such thing as a `triggers` attribute, smells like you used an AI which is clearly documented in our docs: [Introduction | CrowdSec](https://docs.crowdsec.net/docs/next/local_api/notification_plugins/intro#registering-plugin-to-profile)

in short you add the `name` of the plugin to the profiles you wish for them to send on within the `notifications` property. In the example it registers the slack plugin to the profile.

so with the default email name your default `profiles.yaml` should be:

```auto
name: default_ip_remediation
#debug: true
filters:
 - Alert.Remediation == true && Alert.GetScope() == "Ip"
decisions:
 - type: ban
   duration: 4h
#duration_expr: Sprintf('%dh', (GetDecisionsCount(Alert.GetValue()) + 1) * 4)
notifications:
  - email_default
on_success: break
---
name: default_range_remediation
#debug: true
filters:
 - Alert.Remediation == true && Alert.GetScope() == "Range"
decisions:
 - type: ban
   duration: 4h
#duration_expr: Sprintf('%dh', (GetDecisionsCount(Alert.GetValue()) + 1) * 4)
notifications:
  - email_default
on_success: break

```

---

<div class="post-metadata">

**Author:** ![Zoltrix](https://avatars.discourse-cdn.com/v4/letter/z/a88e4f/32.png) [@Zoltrix](https://discourse.crowdsec.net/u/Zoltrix)\
**Post date:** [June 17, 2025, 8:43am UTC](https://discourse.crowdsec.net/t/emails-wont-send-on-ban-or-alert-test-emails-work/2601/3 "2025-06-17T08:43:43Z")

</div>

Thanks for the help. Yes the smelly AI was really adamant about the triggers. I must say I read the doco a good 15 times before reverting to AI 🤣. And I did have it setup exactly as you and the doco described. The only thing I have noticed now is that I only have “-email default” enabled for “default\_range\_remediation”, which I assume should work without having “default\_ip\_remediation” enabled? 🤷‍♂️🤷‍♂️

```auto
name: default_ip_remediation
#debug: true
filters:
 - Alert.Remediation == true && Alert.GetScope() == "Ip"
decisions:
 - type: ban
   duration: 4h
#duration_expr: Sprintf('%dh', (GetDecisionsCount(Alert.GetValue()) + 1) * 4)
# notifications:
# - slack_default # Set the webhook in /etc/crowdsec/notifications/slack.yaml before enabling this.
# - splunk_default # Set the splunk url and token in /etc/crowdsec/notifications/splunk.yaml before enabling this.
# - http_default # Set the required http parameters in /etc/crowdsec/notifications/http.yaml before enabling this.
# - email_default # Set the required email parameters in /etc/crowdsec/notifications/email.yaml before enabling this.
on_success: break
---
name: default_range_remediation
#debug: true
filters:
 - Alert.Remediation == true && Alert.GetScope() == "Range"
decisions:
 - type: ban
   duration: 4h
#duration_expr: Sprintf('%dh', (GetDecisionsCount(Alert.GetValue()) + 1) * 4)
notifications:
# - slack_default # Set the webhook in /etc/crowdsec/notifications/slack.yaml before enabling this.
# - splunk_default # Set the splunk url and token in /etc/crowdsec/notifications/splunk.yaml before enabling this.
# - http_default # Set the required http parameters in /etc/crowdsec/notifications/http.yaml before enabling this.
   - email_default # Set the required email parameters in /etc/crowdsec/notifications/email.yaml before enabling this.
on_success: break

```

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [June 17, 2025, 10:22am UTC](https://discourse.crowdsec.net/t/emails-wont-send-on-ban-or-alert-test-emails-work/2601/4 "2025-06-17T10:22:08Z")

</div>

That means the email will only trigger on `range` remediation, it best to turn it on for both `ip` and `range` remediation.

---

<div class="post-metadata">

**Author:** ![Zoltrix](https://avatars.discourse-cdn.com/v4/letter/z/a88e4f/32.png) [@Zoltrix](https://discourse.crowdsec.net/u/Zoltrix)\
**Post date:** [June 17, 2025, 10:33am UTC](https://discourse.crowdsec.net/t/emails-wont-send-on-ban-or-alert-test-emails-work/2601/5 "2025-06-17T10:33:40Z")

</div>

Yep that did the trick… I guess because most alerts are a single IP… thanks again for the help.