# Get the DMARC policy ladder for a domain

`GET /v1/domain-auth/domains/{domain}/readiness`

- Authentication: required (Bearer token)
- Required scope: `api.domain_auth.view`

Assesses the domain against the policy rung above its current one, with
every criterion carrying the value actually measured beside its
threshold — `met: false` comes with "pass rate 97.2%, needs 98%", which
is a to-do list, rather than a bare cross.

`record_to_publish` is populated ONLY when every criterion is met.
**It is a string to hand a person, not an action.** SendOps does not hold
your DNS credentials and no endpoint here publishes DNS. Advancing a
policy on incomplete evidence starts discarding legitimate mail at every
receiver on the internet, and the failure is invisible from our side: the
policy tightens, the pass rate holds, and the mail stops arriving.

`policy_history_unavailable` says a false `regressed` means "we do not
know" rather than "no". Do not report a domain as un-regressed while it
is true.

## Path parameters

- `domain` (string, required) — The domain, by NAME (`acme.com`). A UUID is also accepted. Matched case-insensitively, and scoped to the calling org — a domain belonging to another org is a 404, never a 403.

## Example request

```bash
curl 'https://api.sendops.dev/v1/domain-auth/domains/string/readiness' \
  -H "Authorization: Bearer $SENDOPS_API_KEY"
```

## Responses

### 200 — The policy ladder and its blocking criteria

Content type: `application/json`

```json
{
  "current_policy": "no_record",
  "target_policy": "no_record",
  "ready": true,
  "ready_pending_acknowledgement": true,
  "cost": {
    "reviewed_messages": 0,
    "reviewed_sources": 0,
    "reviewed_per_day": 0,
    "relay_broken_messages": 0,
    "relay_broken_sources": 0,
    "relay_broken_label": "string",
    "acknowledgement_required": true,
    "acknowledged": true,
    "acknowledgement_stale": true,
    "acknowledged_messages": 0,
    "sentence": "string"
  },
  "record_diff": [
    {
      "tag": "string",
      "kind": "added",
      "from": "string",
      "to": "string",
      "note": "string"
    }
  ],
  "ttl_advice": {
    "record": "string",
    "seconds": 0,
    "why": "string"
  },
  "at_strongest": true,
  "needs_record": true,
  "awaiting_first_report": true,
  "regressed": true,
  "regressed_from": "none",
  "policy_history_unavailable": true,
  "criteria": [
    {
      "key": "coverage_days",
      "label": "string",
      "met": true,
      "actual": "string",
      "required": "string",
      "detail": "string",
      "blocking": true
    }
  ],
  "pass_rate": {
    "raw": 0,
    "adjusted": 0,
    "messages": 0,
    "authenticable_messages": 0,
    "excluded_messages": 0,
    "excluded_sources": 0,
    "campaign_excluded": true,
    "disowned_messages": 0,
    "disowned_sources": 0,
    "disowned_excluded": true,
    "relay_broken_messages": 0,
    "relay_broken_sources": 0,
    "relay_broken_label": "string",
    "relay_broken_excluded": true
  },
  "top_failure_contributor": {
    "label": "string",
    "class": "sendops",
    "failures": 0,
    "share": 0
  },
  "impact": {
    "target_policy": "no_record",
    "sources": [
      {
        "group_kind": "provider",
        "group_key": "string",
        "label": "string",
        "class": "sendops",
        "review_state": "none",
        "failures": 0,
        "volume": 0,
        "last_seen": "2026-05-17T20:00:00Z"
      }
    ],
    "would_affect_messages": 0,
    "campaign_messages_excluded": 0,
    "rejected_messages_excluded": 0,
    "unmeasured_sources": 0,
    "truncated": true,
    "reviewed_messages": 0,
    "reviewed_sources": 0,
    "unreviewed_messages": 0,
    "unreviewed_sources": 0,
    "unreviewed_below_floor_messages": 0,
    "unreviewed_below_floor_sources": 0,
    "relay_broken_messages": 0,
    "relay_broken_sources": 0,
    "relay_broken_label": "string",
    "measured_sources": 0,
    "unmeasured_with_volume_sources": 0,
    "measured_share": 0,
    "completeness": "complete",
    "unmeasured_max_messages": 0,
    "evidence_capped": true,
    "last_measured_at": "string"
  },
  "enforcement": {
    "policy": "quarantine",
    "receivers_reporting": 0,
    "receivers_applying": 0,
    "messages_failed": 0,
    "messages_actioned": 0
  },
  "recommendation": {
    "moment": "",
    "record": "string",
    "record_diff": [
      {
        "tag": "string",
        "kind": "added",
        "from": "string",
        "to": "string",
        "note": "string"
      }
    ],
    "ttl_advice": {
      "record": "string",
      "seconds": 0,
      "why": "string"
    },
    "watch_window_days": 0,
    "watch_window_ends_at": "2026-05-17T20:00:00Z",
    "rollback_record": "string",
    "rollback_reason": "string",
    "headline": "string",
    "detail": "string"
  },
  "record_to_publish": "string",
  "recipient_impact": "string",
  "next_action": {
    "title": "string",
    "body": "string",
    "doc_url": "string",
    "source_label": "string",
    "share": 0
  },
  "alignment_breadth": {
    "measured": true,
    "both_messages": 0,
    "dkim_only_messages": 0,
    "spf_only_messages": 0,
    "passing_messages": 0,
    "both_share": 0,
    "dkim_only_share": 0,
    "spf_only_share": 0,
    "fragile": true,
    "suite_signing_as_itself": "string",
    "sentence": "string"
  },
  "summary": "string"
}
```

### 401 — Missing, malformed, or unknown API key

Content type: `application/problem+json`

```json
{
  "type": "https://example.com",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "invalid_key",
  "request_id": "string",
  "retry_after": 0,
  "retention_days": 0,
  "scope": "string",
  "resource": "string",
  "errors": [
    {
      "field": "string",
      "reason": "string"
    }
  ],
  "attribute_id": "00000000-0000-0000-0000-000000000000",
  "content_hash": "string",
  "differs": [
    "string"
  ]
}
```

### 403 — Key lacks the required scope or plan limit violated

Content type: `application/problem+json`

```json
{
  "type": "https://example.com",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "invalid_key",
  "request_id": "string",
  "retry_after": 0,
  "retention_days": 0,
  "scope": "string",
  "resource": "string",
  "errors": [
    {
      "field": "string",
      "reason": "string"
    }
  ],
  "attribute_id": "00000000-0000-0000-0000-000000000000",
  "content_hash": "string",
  "differs": [
    "string"
  ]
}
```

### 404 — Resource not found

Content type: `application/problem+json`

```json
{
  "type": "https://example.com",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "invalid_key",
  "request_id": "string",
  "retry_after": 0,
  "retention_days": 0,
  "scope": "string",
  "resource": "string",
  "errors": [
    {
      "field": "string",
      "reason": "string"
    }
  ],
  "attribute_id": "00000000-0000-0000-0000-000000000000",
  "content_hash": "string",
  "differs": [
    "string"
  ]
}
```

### 429 — Per-org rate limit exceeded

Content type: `application/problem+json`

```json
{
  "type": "https://example.com",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "invalid_key",
  "request_id": "string",
  "retry_after": 0,
  "retention_days": 0,
  "scope": "string",
  "resource": "string",
  "errors": [
    {
      "field": "string",
      "reason": "string"
    }
  ],
  "attribute_id": "00000000-0000-0000-0000-000000000000",
  "content_hash": "string",
  "differs": [
    "string"
  ]
}
```

### 500 — Unexpected server-side failure. The `code` is `internal_error`. The
`request_id` field can be quoted to SendOps support to investigate.

Content type: `application/problem+json`

```json
{
  "type": "https://example.com",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "invalid_key",
  "request_id": "string",
  "retry_after": 0,
  "retention_days": 0,
  "scope": "string",
  "resource": "string",
  "errors": [
    {
      "field": "string",
      "reason": "string"
    }
  ],
  "attribute_id": "00000000-0000-0000-0000-000000000000",
  "content_hash": "string",
  "differs": [
    "string"
  ]
}
```