diff --git a/alert-policies/postfix/ConnectionLost.yml b/alert-policies/postfix/BouncedEmails.yml
similarity index 79%
rename from alert-policies/postfix/ConnectionLost.yml
rename to alert-policies/postfix/BouncedEmails.yml
index c80b665ba1..7ecaa3eaee 100644
--- a/alert-policies/postfix/ConnectionLost.yml
+++ b/alert-policies/postfix/BouncedEmails.yml
@@ -1,16 +1,16 @@
 # Name of the alert
-name: SMTPD Connection Lost (%)
+name: Bounced Emails
 
 # Description and details
 description: |+
-  This alert is triggered when the lost connections exceed 5%.
+  This alert is triggered when bounced emails exceed 5.
 
 # Type of alert
 type: STATIC
 
 # NRQL query
 nrql:
-  query: "SELECT (latest(PostfixSMTPDconnectionLost.value) * 100) / (SELECT latest(value) FROM PostfixSMTPDconnection) AS '(%) connection lost' FROM PostfixSMTPDconnectionLost"
+  query: "SELECT latest(bounced) As 'Bounced - failed emails' FROM `unixMonitor:postfix_messagesTotalRecords`"
 
 # Function used to aggregate the NRQL query value(s) for comparison to the terms.threshold (Default: SINGLE_VALUE)
 valueFunction: SINGLE_VALUE
diff --git a/alert-policies/postfix/ConnectionTimeout.yml b/alert-policies/postfix/SMTPAuthenticationFails.yml
similarity index 79%
rename from alert-policies/postfix/ConnectionTimeout.yml
rename to alert-policies/postfix/SMTPAuthenticationFails.yml
index 902c56a9ab..764914d8f5 100644
--- a/alert-policies/postfix/ConnectionTimeout.yml
+++ b/alert-policies/postfix/SMTPAuthenticationFails.yml
@@ -1,16 +1,16 @@
 # Name of the alert
-name: SMTPD Connection Timed Out (%)
+name: SMTP Authentication Fails
 
 # Description and details
 description: |+
-  This alert is triggered when the connection timeout exceeds 5%.
+  This alert is triggered when SMTP authentication fails exceed 5.
 
 # Type of alert
 type: STATIC
 
 # NRQL query
 nrql:
-  query: "SELECT (latest(PostfixSMTPDtimedOut.value) * 100) / (SELECT latest(value) FROM PostfixSMTPDconnection) AS '(%) connection timed out' FROM PostfixSMTPDtimedOut"
+  query: "SELECT latest(smtp_authfailed_count) FROM `unixMonitor:postfix_smtp_authFailed_today`"
 
 # Function used to aggregate the NRQL query value(s) for comparison to the terms.threshold (Default: SINGLE_VALUE)
 valueFunction: SINGLE_VALUE