---
title: "Get email authentication standing for a sending domain"
method: GET
path: "/v1/email/inbox-insights/authentication"
tags: ["email-inbox-insights"]
---

# Get email authentication standing for a sending domain

`GET /v1/email/inbox-insights/authentication`

## Request

- Base URL: `https://us1.platform.bird.com`
- URL: `https://us1.platform.bird.com/v1/email/inbox-insights/authentication`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `bird_session`

Returns whether the domain's mail authenticates and who sends as the
domain: SPF and DKIM pass rates, the DMARC standing with its published
policy and a conservative ready-for-reject judgement, and a per-source
table showing every system observed sending under the domain's name,
forwarders and unidentified senders included.

The DMARC figures name their source: authoritative aggregate reporting
that covers every sender, or Google Postmaster as a fallback covering
only mail Google received. Aggregate reports arrive on reporters' own
schedules, routinely a day or more behind, so the source table names its
latest included day; label from it rather than reading the newest days'
sparseness as a regression. For a domain with neither reporting source
configured, sections report `not_configured` with a setup path, not an
error.

## Query parameters

- `sending_domain` string, required
- `from` string, date
- `to` string, date
- `compare` 'previous_period': Set to `previous_period` to include the immediately preceding window of equal length in the same response, so deltas need no second request.

## Headers

- `X-Workspace-Id` string
- `X-Organization-Id` string

## Response `200`

Authentication standing for the requested domain and period.

- EmailInboxInsightsAuthentication: The meta every Inbox Insights resource carries, whatever it measures, so one client adapter serves them all.
  - `resource` string, required: Which resource this response is, echoed for self-description.
  - `domain` string, required: The sending domain the figures describe.
  - `measurement` EmailInboxInsightsMeasurement: How the figures in this response were measured, so a number is self-describing in a screenshot or a bug report.
    - `sources` string[], required: Identifiers of the measurement systems that contributed to these figures. The set grows as measurement coverage does, so treat the values as labels rather than a closed list.
    - `weighting` EmailInboxInsightsWeighting: How the placement figures in this response were weighted, so a number is self-describing wherever it is quoted or screenshotted. Placement rates are a weighted average of per-provider rates against an audience mix (the share of recipients expected at each mailbox provider) rather than a share of delivered volume.
      - `weight_set_id` string, required: The measurement's own identifier for the audience mix, carried through so a client can tell two weightings apart without comparing `basis` strings. No operation accepts it.
      - `source` 'account' | 'global', required: Where the audience mix behind the placement weighting came from: `account` when it was configured for this account, `global` when a general default was used instead.
      - `basis` string, nullable, required: The weighting method behind the rates, as the measurement names it. A slug rather than a sentence, so render it as a label and do not expect it to read as English. Null when the measurement did not state one, which pairs with `source`: both describe the method, so neither can claim to know it when the measurement was silent.
  - `generated_at` string, date-time, required: When these figures were computed. The measurement service's own stamp where it publishes one; on the resources Bird derives from daily rates it has none to publish, and this is when Bird computed them.
  - `freshness` EmailInboxInsightsFreshness, required: How current the figures are. Freshness differs per resource (authentication data can lag a day or more while blocklist lookups are near real time), so any "as of" label binds from this field, never from a fixed string.
    - `as_of` string, date, nullable, required: The most recent UTC day the figures include, or null for a live lookup that has no measurement window.
    - `lag_hint` string, nullable, required: How far behind real time this resource usually runs. A lowercase identifier rather than a display label, so pick your own wording for it, and treat the set as open: the measurement names a hint per resource and can add one without notice. Null when the measurement reports no hint, which several resources do: show the figures without an age rather than inventing one.
  - `cached_at` string, date-time: Present when the response was served from a short-lived copy rather than fetched for this request: when that copy was fetched.
  - `window` EmailInboxInsightsWindow, required: The period every figure in the response covers: whole UTC calendar days, inclusive on both ends. The same window convention the email statistics endpoints use, so figures from the two sources describe the same days and can be combined without adjustment.
    - `start` string, date, required: First UTC day of the period, inclusive.
    - `end` string, date, required: Last UTC day of the period, inclusive.
    - `group_by` 'day' | 'week' | 'month': The bucket size a series is grouped by. Day suits the product's charts; wider grains suit long ranges.
  - `compared_to` EmailInboxInsightsComparedTo: The prior equal-length period the delta figures compare against. Present only when the request asked for a comparison.
    - `start` string, date, required: First UTC day of the prior period, inclusive.
    - `end` string, date, required: Last UTC day of the prior period, inclusive.
  - `spf` EmailInboxInsightsAuthPassRate, required: One authentication check's pass rate over the period.
    - `pass_rate_percent` number, nullable, required: Share of the domain's measured mail that passed this check, as a percentage.
    - `delta_pts` number: How the pass rate moved against the prior period, in percentage points. Present only when the request asked for a comparison and the prior period had data; absence is not zero change.
    - `source` string, nullable, required: Where this figure comes from. `dmarc_rua` is authoritative aggregate reporting and covers every sender of the domain, forwarders included; `google_postmaster` is a fallback covering only mail Google received. It can differ from the source of the DMARC figures, so surface it per check rather than once per response. Null on a check that reports no figure at all, which is what a `not_configured` status means: there is no measurement, so there is no source to name.
    - `status` 'ok' | 'no_data' | 'not_configured' | 'unavailable' | 'not_applicable', required: Whether a section of the response carries figures, and when it does not, why. `ok` means the section is populated. `no_data` means the measurement ran and observed nothing to report for this domain in the period. `not_configured` means the section needs a setup step that has not been completed yet, such as connecting Google Postmaster Tools; treat it as an invitation to finish setup rather than a fault. `unavailable` means the figures could not be retrieved this time and the same request may well succeed on a retry; the rest of the response is unaffected. `not_applicable` means the section is meaningless for this domain in this period, so there is nothing to show or fix. A successful response never implies every section is populated; read each section's status rather than assuming figures are present.
  - `dkim` EmailInboxInsightsAuthPassRate, required: One authentication check's pass rate over the period.
    - `pass_rate_percent` number, nullable, required: Share of the domain's measured mail that passed this check, as a percentage.
    - `delta_pts` number: How the pass rate moved against the prior period, in percentage points. Present only when the request asked for a comparison and the prior period had data; absence is not zero change.
    - `source` string, nullable, required: Where this figure comes from. `dmarc_rua` is authoritative aggregate reporting and covers every sender of the domain, forwarders included; `google_postmaster` is a fallback covering only mail Google received. It can differ from the source of the DMARC figures, so surface it per check rather than once per response. Null on a check that reports no figure at all, which is what a `not_configured` status means: there is no measurement, so there is no source to name.
    - `status` 'ok' | 'no_data' | 'not_configured' | 'unavailable' | 'not_applicable', required: Whether a section of the response carries figures, and when it does not, why. `ok` means the section is populated. `no_data` means the measurement ran and observed nothing to report for this domain in the period. `not_configured` means the section needs a setup step that has not been completed yet, such as connecting Google Postmaster Tools; treat it as an invitation to finish setup rather than a fault. `unavailable` means the figures could not be retrieved this time and the same request may well succeed on a retry; the rest of the response is unaffected. `not_applicable` means the section is meaningless for this domain in this period, so there is nothing to show or fix. A successful response never implies every section is populated; read each section's status rather than assuming figures are present.
  - `dmarc` EmailInboxInsightsDmarc, required: The domain's DMARC standing over the period.
    - `aligned_rate_percent` number, nullable, required: Share of the domain's measured mail that passed DMARC alignment, as a percentage.
    - `policy` 'none' | 'quarantine' | 'reject', required: The DMARC policy published in the domain's DNS record: what receivers are asked to do with mail that fails DMARC.
    - `ready_for_reject` boolean, nullable, required: Whether the domain's authentication is consistent enough to move the policy to `reject` without losing legitimate mail. Deliberately conservative: false whenever the data is insufficient to be sure. Null when the measurement reached no verdict, which is what a `status` other than `ok` means here: false would read as a considered "not yet" rather than as no assessment having been made.
    - `readiness_reasons` EmailInboxInsightsDmarcReadinessReason[], nullable, required: Why `ready_for_reject` is false, so the answer is actionable rather than a bare refusal. Empty when nothing is holding the domain back, and null when readiness was not assessed, which pairs with `ready_for_reject`: an empty list alongside a null verdict would say the opposite of what was measured. Render these rather than a plain "not ready": the fix differs per reason, and a domain held back only by stale reporting needs no configuration change at all.
    - `delta_pts` number: How the aligned rate moved against the prior period, in percentage points. Present only when the request asked for a comparison and the prior period had data; absence is not zero change.
    - `source` string, nullable, required: Where the DMARC figures come from. `dmarc_rua` is authoritative aggregate reporting and covers every sender of the domain, forwarders included; `google_postmaster` is a fallback covering only mail Google received. The two are not equivalent, so surface which one is shown. Null when the section reports no figures, which is what a `not_configured` status means for a domain with no aggregate reporting and no Postmaster connection.
    - `status` 'ok' | 'no_data' | 'not_configured' | 'unavailable' | 'not_applicable', required: Whether a section of the response carries figures, and when it does not, why. `ok` means the section is populated. `no_data` means the measurement ran and observed nothing to report for this domain in the period. `not_configured` means the section needs a setup step that has not been completed yet, such as connecting Google Postmaster Tools; treat it as an invitation to finish setup rather than a fault. `unavailable` means the figures could not be retrieved this time and the same request may well succeed on a retry; the rest of the response is unaffected. `not_applicable` means the section is meaningless for this domain in this period, so there is nothing to show or fix. A successful response never implies every section is populated; read each section's status rather than assuming figures are present.
  - `sources` EmailInboxInsightsAuthSources, required: Every system observed sending as this domain, with how each authenticates. This is the table that shows who else sends under the domain's name.
    - `items` EmailInboxInsightsAuthSource[], required: One row per observed sending source.
      - `name` string, required: The sending source as the reporting identifies it. Not a fixed list: unidentified senders, mostly forwarders, appear as a real category.
      - `category` string, nullable, required: A coarse classification of the source. The set can grow; treat values as labels. Null when the measurement did not classify this sender.
      - `volume` integer, required: Messages the reporting attributes to this source over the period.
      - `spf_aligned_rate_percent` number, nullable, required: Share of this source's mail that passed SPF with alignment, as a percentage.
      - `dkim_aligned_rate_percent` number, nullable, required: Share of this source's mail that passed DKIM with alignment, as a percentage.
      - `dmarc_pass_rate_percent` number, nullable, required: Share of this source's mail that passed DMARC, as a percentage.
      - `verdict` string, required: How a sending source's mail authenticates against the domain's DMARC policy. `aligned` passes with both SPF and DKIM aligned; `dkim_only` and `spf_only` pass on one mechanism; `fails_policy` passes neither. The reporting decides this set and can add to it, so treat an unrecognised value as a label to show rather than a case to exhaust. A source whose verdict is new still belongs in the table.
      - `qualifies_for_readiness` boolean, required: Whether this source counts toward the reject recommendation. A source that does not is excluded from that judgement, which is what lets this table explain a conservative recommendation instead of contradicting it.
    - `latest_data_date` string, date, nullable, required: The most recent UTC day the source reporting includes. Aggregate DMARC reports arrive on reporters' own schedules, routinely a day or more behind, so the newest days look sparse; label from this date rather than treating the dip as a regression.
    - `status` 'ok' | 'no_data' | 'not_configured' | 'unavailable' | 'not_applicable', required: Whether a section of the response carries figures, and when it does not, why. `ok` means the section is populated. `no_data` means the measurement ran and observed nothing to report for this domain in the period. `not_configured` means the section needs a setup step that has not been completed yet, such as connecting Google Postmaster Tools; treat it as an invitation to finish setup rather than a fault. `unavailable` means the figures could not be retrieved this time and the same request may well succeed on a retry; the rest of the response is unaffected. `not_applicable` means the section is meaningless for this domain in this period, so there is nothing to show or fix. A successful response never implies every section is populated; read each section's status rather than assuming figures are present.

## Other responses

- `400`: Bad request
- `401`: Authentication required
- `403`: Insufficient permissions
- `404`: Resource not found
- `412`: Precondition failed
- `422`: The request has invalid field values, violates a business rule, or carries a query parameter the endpoint does not declare. Field validation errors use `type: validation_error` and include the affected fields in `details`. Business-rule errors identify the failed rule in `type`.
- `429`: Rate limit exceeded
- `500`: Internal server error
- `503`: The service is temporarily unavailable. If `Retry-After` is present, wait for that delay before retrying; otherwise, retry with exponential backoff. Reuse the same idempotency key and request when retrying a mutation.

---

[API](https://skmtc.dev/messagebird/apis/bird-api.md) · [All operations](https://skmtc.dev/messagebird/apis/bird-api/llms.txt) · [OpenAPI document](https://skmtc.dev/messagebird/apis/bird-api/revisions/6dfce1179799?raw)