List DMARC reporting posture per domain
Returns each of the org's domains with its published DMARC policy, reporting coverage and source counts.
source_counts carries two different groupings and they must not be
conflated. The five class counts partition total — what the traffic is
made of. alerting answers a separate question — how much of it needs a
human — and may overlap any of them; it is the field to read for "is
something wrong with this domain", not unknown. awaiting_decision
and open_finding partition alerting exactly, and only the first can
be reduced by a decision.
traffic is null when the window holds no report data. Null is not
zero: a domain nobody has reported on has no pass rate, and rendering 0%
would report total failure where there is only silence.
Query parameters
limit integer optional Page size (1–200). Default 50.
Responses
Errors follow the RFC 7807 problem format — see the error reference.
data array<object> required Each entry in data:
domain string required dmarc_record string optional The record as last OBSERVED in DNS, not one we hold. Absent means none was published at the last check.
policy string enum required The enforcement level currently published. no_record is NOT the same as none: none is a deliberate choice to monitor, absence is the absence of a choice. An unparseable record reads as no_record rather than being guessed at.
One of: no_record, none, quarantine, reject
report_address string optional Where this domain's aggregate reports are delivered.
has_reports boolean required has_tls_reports boolean required first_report_at string<date-time> optional last_report_at string<date-time> optional report_count integer<int64> required source_counts object required Two DIFFERENT groupings. The five class counts partition total. alerting answers a separate question and may overlap any of them. awaiting_decision and open_finding partition alerting exactly.
Fields of source_counts:
total integer<int64> required sendops integer<int64> required The org's own SES
sendops_relayed integer<int64> required The org's own mail via a host that is not their SES.
sendops_unaligned integer<int64> required The org's own SES
known integer<int64> required A third party the org confirmed.
unknown integer<int64> required alerting integer<int64> required How much of the traffic needs a human. NOT part of the partition above — read this, not unknown, for "is something wrong with this domain".
awaiting_decision integer<int64> required The only count a decision can reduce.
open_finding integer<int64> required Needs a DNS record, a third party, or the policy ladder — not a decision.
traffic object | null required Null when the reporting window holds no data. Null is not zero — a domain nobody reported on has no pass rate.
dispersion object | null optional Null when the nightly classification pass has never measured this domain. Null is NOT "no campaign detected" — that is a claim, and an unmeasured domain has not earned it.
pagination object required Fields of pagination:
has_more boolean required next_cursor string | null optional code is internal_error. The
request_id field can be quoted to SendOps support to investigate.
application/problem+json