List DMARC reporting posture per domain

Search Documentation

Search across all developer documentation

domain-auth

List DMARC reporting posture per domain

GET /v1/domain-auth/domains
Auth required api.domain_auth.view

Returns each of the org's domains with its published DMARC policy, reporting coverage and source counts.

source_counts carries two different groupings and they must not be conflated. The five class counts partition total — what the traffic is made of. alerting answers a separate question — how much of it needs a human — and may overlap any of them; it is the field to read for "is something wrong with this domain", not unknown. awaiting_decision and open_finding partition alerting exactly, and only the first can be reduced by a decision.

traffic is null when the window holds no report data. Null is not zero: a domain nobody has reported on has no pass rate, and rendering 0% would report total failure where there is only silence.

Query parameters

limit integer optional

Page size (1–200). Default 50.

Responses

Errors follow the RFC 7807 problem format — see the error reference.

200 List of domains with their reporting posture application/json
data array<object> required

Each entry in data:

domain string required
dmarc_record string optional

The record as last OBSERVED in DNS, not one we hold. Absent means none was published at the last check.

policy string enum required

The enforcement level currently published. no_record is NOT the same as none: none is a deliberate choice to monitor, absence is the absence of a choice. An unparseable record reads as no_record rather than being guessed at.

One of: no_record, none, quarantine, reject

report_address string optional

Where this domain's aggregate reports are delivered.

has_reports boolean required
has_tls_reports boolean required
first_report_at string<date-time> optional
last_report_at string<date-time> optional
report_count integer<int64> required
source_counts object required

Two DIFFERENT groupings. The five class counts partition total. alerting answers a separate question and may overlap any of them. awaiting_decision and open_finding partition alerting exactly.

Fields of source_counts:

total integer<int64> required
sendops integer<int64> required

The org's own SES

sendops_relayed integer<int64> required

The org's own mail via a host that is not their SES.

sendops_unaligned integer<int64> required

The org's own SES

known integer<int64> required

A third party the org confirmed.

unknown integer<int64> required
alerting integer<int64> required

How much of the traffic needs a human. NOT part of the partition above — read this, not unknown, for "is something wrong with this domain".

awaiting_decision integer<int64> required

The only count a decision can reduce.

open_finding integer<int64> required

Needs a DNS record, a third party, or the policy ladder — not a decision.

traffic object | null required

Null when the reporting window holds no data. Null is not zero — a domain nobody reported on has no pass rate.

dispersion object | null optional

Null when the nightly classification pass has never measured this domain. Null is NOT "no campaign detected" — that is a claim, and an unmeasured domain has not earned it.

pagination object required

Fields of pagination:

has_more boolean required
next_cursor string | null optional
401 Missing, malformed, or unknown API key application/problem+json
403 Key lacks the required scope or plan limit violated application/problem+json
422 Query parameter or path value failed validation application/problem+json
429 Per-org rate limit exceeded application/problem+json
500 Unexpected server-side failure. The code is internal_error. The request_id field can be quoted to SendOps support to investigate. application/problem+json