tutorial

Monitoring Chasquid SMTP Mail Server with Vigilmon

Chasquid is a minimal, security-focused SMTP server written in Go — but silently stuck mail queues and expired TLS certificates can go unnoticed for days. Here's how to monitor every layer of your Chasquid setup with Vigilmon.

Chasquid is a Go-based SMTP server designed for simplicity and security in small installations. It handles inbound and outbound mail delivery, enforces TLS on every connection, integrates with Dovecot for local delivery via LMTP, and ships with a built-in HTTP monitoring endpoint. What it doesn't do is alert you when its own components fail: a stuck outbound queue that won't retry, an expired TLS certificate that silently rejects inbound connections, or a Dovecot LMTP endpoint that's gone offline. Vigilmon fills that gap, giving you proactive monitoring across every critical Chasquid component.

What You'll Set Up

  • SMTP server availability (port 25)
  • SMTPS (port 465) and submission (port 587) port monitoring
  • TLS certificate expiry alerts per domain
  • Chasquid HTTP monitoring endpoint health check
  • Dovecot LMTP delivery connectivity (port 24)
  • Outbound mail queue health via cron heartbeat
  • MX DNS record resolution health

Prerequisites

  • Chasquid installed and running with SMTP on 25, SMTPS on 465, submission on 587
  • Chasquid HTTP monitoring endpoint enabled (default: port 1099)
  • Dovecot running with LMTP socket or TCP on port 24
  • A free Vigilmon account

Step 1: Monitor the SMTP Port (Port 25)

Port 25 is the primary inbound SMTP port. Other mail servers connect here to deliver mail to your domains. If it's unreachable, you silently stop receiving email.

  1. Log in to vigilmon.online and click Add Monitor.
  2. Set Type to TCP Port.
  3. Host: mail.yourdomain.com.
  4. Port: 25.
  5. Check interval: 1 minute.
  6. Timeout: 10 seconds.
  7. Click Save.

Port 25 is blocked by many residential ISPs but not by monitoring services probing from data centers. If Vigilmon's check nodes are also blocked, use the SMTPS check (Step 2) as your primary connectivity signal and the HTTP monitoring endpoint (Step 4) for process-level health.

Step 2: Monitor SMTPS (Port 465) and Submission (Port 587)

Port 465 (SMTPS, implicit TLS) and port 587 (submission, STARTTLS) are used by email clients to send mail. A down submission port means your users can't send.

SMTPS (465):

  1. Click Add Monitor → TCP Port.
  2. Host: mail.yourdomain.com.
  3. Port: 465.
  4. Check interval: 1 minute.
  5. Timeout: 10 seconds.
  6. Click Save.

Submission (587):

  1. Click Add Monitor → TCP Port.
  2. Host: mail.yourdomain.com.
  3. Port: 587.
  4. Check interval: 1 minute.
  5. Timeout: 10 seconds.
  6. Click Save.

Label these Chasquid SMTPS and Chasquid submission respectively for clear alert messages.

Step 3: Monitor the Chasquid HTTP Monitoring Endpoint

Chasquid exposes an HTTP endpoint (default port 1099) with internal metrics and queue status. This is your best process-level health signal — it's served directly by the Chasquid process, so it's alive if and only if Chasquid is running.

  1. Click Add Monitor → HTTP / HTTPS.
  2. URL: http://mail.yourdomain.com:1099/debug/status
  3. Check interval: 1 minute.
  4. Expected HTTP status: 200.
  5. Enable Keyword match: chasquid (appears in the status page HTML).
  6. Click Save.

The Chasquid HTTP endpoint also exposes /debug/queue for queue inspection and /debug/vars for Go expvar metrics. Monitor /debug/status as your primary check — it's lightweight and comprehensive.

Step 4: TLS Certificate Expiry Alerts

Chasquid enforces TLS on all inbound connections. An expired certificate causes other mail servers to reject your server with a TLS handshake error, silently breaking inbound delivery.

For each domain you host mail for:

  1. Open the SMTPS TCP monitor for mail.yourdomain.com.
  2. Change the monitor type to HTTP / HTTPS (port 443 or use the SMTPS port 465 with TLS).
  3. Enable Monitor SSL certificate.
  4. Set Alert when certificate expires in less than 21 days.
  5. Click Save.

Alternatively, add a dedicated TLS check for your mail domain:

  1. Click Add Monitor → HTTP / HTTPS.
  2. URL: https://mail.yourdomain.com (if you serve HTTPS on 443) or use a port-specific TLS check.
  3. Enable Monitor SSL certificate.
  4. Alert threshold: 21 days.
  5. Click Save.

A 21-day alert window gives you three full renewal cycles if your ACME/Let's Encrypt renewal is misconfigured.

Step 5: Monitor Dovecot LMTP Delivery

Chasquid delivers local mail to Dovecot via LMTP (Local Mail Transfer Protocol), typically on a Unix socket or TCP port 24. If Dovecot's LMTP listener goes down, inbound mail to local users bounces or queues indefinitely.

TCP check for Dovecot LMTP (if using TCP):

  1. Click Add Monitor → TCP Port.
  2. Host: localhost (or 127.0.0.1).
  3. Port: 24.
  4. Check interval: 2 minutes.
  5. Timeout: 5 seconds.
  6. Click Save.

If Dovecot uses a Unix socket instead of TCP, monitor the Dovecot admin socket indirectly via Dovecot's own HTTP stats endpoint (if enabled), or monitor inbound delivery success via the cron heartbeat pattern in Step 6.

Step 6: Outbound Queue Health via Cron Heartbeat

Chasquid's outbound queue retries stuck messages automatically — but if the queue processor stops retrying (due to an internal error or resource exhaustion), email piles up silently. Use Vigilmon's cron heartbeat to detect a frozen queue.

  1. In Vigilmon, click Add Monitor → Cron Heartbeat.
  2. Set expected ping interval to 30 minutes (Chasquid's default queue retry cycle).
  3. Copy the heartbeat URL.
  4. Create a systemd timer or cron job that probes the Chasquid queue via the HTTP debug endpoint and pings Vigilmon if the queue is moving:
#!/bin/bash
# Check Chasquid queue status and ping heartbeat if healthy
QUEUE_SIZE=$(curl -s http://localhost:1099/debug/queue | grep -c "item")
MAX_STUCK=50

if [ "$QUEUE_SIZE" -lt "$MAX_STUCK" ]; then
    curl -s https://vigilmon.online/heartbeat/YOUR_HEARTBEAT_ID
fi

If the queue exceeds your threshold or the script fails to run, Vigilmon alerts after 30 minutes of missed pings.

Step 7: MX DNS Record Resolution Health

Your domain's MX records must resolve correctly for other mail servers to find you. An MX misconfiguration (wrong priority, expired TTL, deleted record) silently breaks inbound delivery from senders outside your control.

Use Vigilmon's HTTP monitor to probe your domain's MX via a DNS-over-HTTPS resolver:

  1. Click Add Monitor → HTTP / HTTPS.
  2. URL: https://dns.google/resolve?name=yourdomain.com&type=MX
  3. Check interval: 15 minutes.
  4. Expected HTTP status: 200.
  5. Enable Keyword match: mail.yourdomain.com — your MX hostname should appear in the response.
  6. Click Save.

This catches MX record deletion or incorrect propagation without requiring a custom DNS probe.

Step 8: Configure Alert Channels

  1. Go to Alert Channels in Vigilmon and add Slack, email, or PagerDuty webhook.
  2. For port 25, 465, and 587 TCP monitors: Consecutive failures before alert = 2 — brief TCP resets can cause single-check false positives.
  3. For the Chasquid HTTP monitoring endpoint: Consecutive failures before alert = 1 — if Chasquid's own HTTP server is down, the process has likely crashed.
  4. For TLS certificate expiry: set the email channel in addition to Slack so certificate alerts reach an inbox even if Slack is down.

Summary

| Monitor | Target | What It Catches | |---|---|---| | SMTP port | :25 TCP | Inbound mail delivery failure | | SMTPS port | :465 TCP | Encrypted client SMTP failure | | Submission port | :587 TCP | Email client send failure | | HTTP monitoring | :1099/debug/status | Chasquid process crash | | TLS certificate | Mail domain | Certificate expiry, delivery rejection | | Dovecot LMTP | :24 TCP | Local delivery failure | | Queue heartbeat | Heartbeat URL | Frozen outbound queue | | MX DNS | DNS-over-HTTPS | MX record deletion/misconfiguration |

Chasquid's simplicity is deliberate — it does one thing (SMTP) and does it securely. But that simplicity means no built-in alerting. With Vigilmon covering port health, TLS expiry, LMTP delivery, and queue movement, you get full-stack email infrastructure visibility without adding operational complexity.

Monitor your app with Vigilmon

Free plan — 5 monitors, no credit card required. Up and running in 60 seconds.

Start free →
← Back to all articles