I don't know if this is a "Feature Request" or whether it's burried somewhere in the options...
Can I choose which events trigger an email? 
For example, right now, I'd like to only get the notification when fwknopd receives a knock.  I currently get that, and then 30sec later I get a notice that the fw has been closed-up (right on time, yes, but I kind of trust it enough that I can assume that is the case).
Some options I can think of:
- Notify on any Knock
- Notify on (only) invalid/failed Knock-Attempt
- Notify on Timeout Action
- Notify on ALL (what I think is the current functionality)
PS: And while we're at Feature Requests, a great feature that is only loosely related, would be to notify on detected port-scans or DoS attempts.  Since you're already sniffing all the traffic on all the ports, you would be able to detect this quite easily (I think), and you already have the notification and logging capabilities coded and ready!