---
title: "Query relay logs"
method: GET
path: "/api/logs"
tags: ["Logs & Analytics"]
---

# Query relay logs

`GET /api/logs`

## Request

- Base URL: `https://arc-relay.com`
- URL: `https://arc-relay.com/api/logs`
- Auth: HTTP bearer

## Query parameters

- `page` integer
- `limit` integer
- `domain` string
- `status` 'delivered' | 'rejected' | 'failed'
- `q` string
- `from_domain` string
- `from` string, date-time
- `to` string, date-time
- `format` 'json' | 'markdown'

## Response `200`

Logs, newest first. With format=markdown (or Accept: text/markdown), a Markdown table instead, whose last two columns are the From: domain and whether it was verified.

- object
  - `logs` RelayLogEntry[]
    - `id` string, uuid
    - `domain` string
    - `sender` string: Envelope sender (MAIL FROM), not the From: header
    - `recipient` string
    - `status` 'delivered' | 'rejected' | 'failed'
    - `reason` string, nullable
    - `srs_from` string, nullable
    - `plan` string, nullable
    - `relay_latency_ms` number, nullable
    - `created_at` string, date-time
    - `auth` RelayLogAuth: Sender-authentication results the relay recorded when it received the message, read back from the log row (reading them makes no DNS lookup). They are about the From: header domain only, never the address, the display name or the content.
      - `from_domain` string, nullable: Domain of the single address in the visible From: header, lower-case ASCII (internationalized domains in xn-- form). null when the header had no address, more than one, or one that could not be read.
      - `from_domain_verified` boolean, nullable: true when a verified DKIM signature is aligned with from_domain (dkim.aligned), or envelope_spf is pass and envelope_domain equals from_domain exactly. false means this relay did not demonstrate it, not that the mail is forged. null when from_domain is null. A lookalike domain verifies for itself: compare from_domain with the domain you expect.
      - `verified_by` string[]: The rules that made from_domain_verified true; empty otherwise.
      - `envelope_domain` string, nullable: Domain of the envelope sender (the entry's sender); null when it has none, as for the null sender.
      - `envelope_spf` 'pass' | 'not_pass' | 'null', nullable: The relay's SPF check of the envelope sender at the IP that connected to the relay. not_pass covers every other outcome, for example fail, softfail, none, an error, no usable client IP or the null sender. null when not recorded.
      - `dkim` object
        - `result` 'pass' | 'fail' | 'none' | 'null', nullable: pass: at least one DKIM-Signature verified that signs the From: header and does not use rsa-sha1; a signature that does not sign From:, or uses rsa-sha1, is not counted (RFC 6376, RFC 8301). fail: signed, but no such signature verified. none: not signed.
        - `domain` string, nullable: d= of a verified signature, an aligned one when there is one; null when no signature verified.
        - `aligned` boolean, nullable: true when a verified signature is aligned with from_domain (relaxed alignment: same organizational domain), false when none is. null when from_domain is null.
      - `dmarc` object
        - `result` 'pass' | 'fail' | 'none' | 'temperror' | 'null', nullable: DMARC for from_domain as the relay computed it, the dmarc= result in the Authentication-Results header it adds to the forwarded copy. It counts DKIM signatures and SPF of the envelope sender, checked at the IP of the server that connected to the relay (from the Received header the relay's own mail server added). Alignment is relaxed even when the DMARC record of from_domain sets adkim=s (or aspf=s), so pass can be wrong for such a domain when the signing or envelope domain is not from_domain but shares its organizational domain. It also credits DKIM signatures that dkim.result does not count, so pass can come with from_domain_verified false. none: no DMARC record. null when from_domain is null.
        - `policy` 'none' | 'quarantine' | 'reject' | 'null', nullable: The policy from_domain publishes (sp for a subdomain when the record sets it, otherwise p), when result is pass or fail. The relay does not reject or hold mail on the DMARC result.
      - `arc` object
        - `result` 'pass' | 'fail' | 'none' | 'null', nullable: The ARC chain on the incoming message: pass (intact), fail (broken), none (no chain). The relay does not use it to change any other result.
        - `domain` string, nullable: d= of the newest ARC-Message-Signature when result is pass. An intact chain is worth only as much as you trust this domain.
  - `total` integer
  - `page` integer
  - `limit` integer
  - `pages` integer

## Other responses

- `400`: from_domain is not a domain name
- `503`: from_domain was given, but this server is not recording From: domains yet; query without it

---

[API](https://skmtc.dev/arc-relay/apis/arc-relay-api.md) · [All operations](https://skmtc.dev/arc-relay/apis/arc-relay-api/llms.txt) · [OpenAPI document](https://skmtc.dev/arc-relay/apis/arc-relay-api/revisions/1743ed2c49bc?raw)