---
title: "DMARC aggregate reports for your domains"
method: GET
path: "/api/v1/deliverability/dmarc"
tags: ["Deliverability"]
---

# DMARC aggregate reports for your domains

`GET /api/v1/deliverability/dmarc`

## Request

- Base URL: `https://api.sendly.now`
- URL: `https://api.sendly.now/api/v1/deliverability/dmarc`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `better-auth.session_token`
  - OAuth 2 (authorization code, authorization URL `https://app.sendly.now/api/auth/oauth2/authorize`, token URL `https://app.sendly.now/api/auth/oauth2/token`, scopes: `deliverability:read`)

DMARC aggregate (RUA) reports receiving providers have sent about your verified domains, newest reporting window first.

The only signal on this surface that does not come from us. A report is a receiver saying what it saw arrive claiming to be your domain, from every source — which is how a sender finds out both that their own alignment is broken and that somebody else is sending as them.

`pass_count` counts DMARC ALIGNMENT from `policy_evaluated`, not raw authentication results: a message can pass SPF for a domain that is not the one in its From header, and that is precisely the case DMARC exists to catch.

Only reports about a domain registered in this project are stored, so a report about a domain you have not added will not appear here.

Requires the `deliverability:read` scope — Check why mail from one of your domains is not arriving.

## Query parameters

- `limit` integer
- `after` string: Opaque cursor from a previous response's `next_cursor`.
- `days` integer: How far back to read, by the report's window start. 1-180 days; defaults to 30.
- `domain` string: Restrict to reports about one of your domains.

## Response `200`

Cursor-paginated DMARC aggregate reports

- DmarcReportV1List: Cursor-paginated DMARC aggregate reports, newest window first.
  - `data` DmarcReportV1[], required
    - `fail_count` integer, required
    - `id` string, required
    - `org_name` string, required: The reporting receiver, e.g. `google.com`.
    - `pass_count` integer, required: Messages DMARC-ALIGNED (SPF or DKIM aligned and passing), from `policy_evaluated`. Not the raw auth results: a message can pass SPF for a domain that is not the one in its From header, which is the case DMARC exists to catch.
    - `policy_domain` string, required: The domain of yours the report is about.
    - `range_begin` string, date-time, required
    - `range_end` string, date-time, required
    - `received_at` string, date-time, required
    - `report_id` string, required: The receiver's own id for this report.
    - `sources` object[], required: Per-sending-source rows, as the receiver reported them.
      - `count` integer, required
      - `disposition` string, required
      - `dkim` string, required
      - `header_from` string, required
      - `source_ip` string, required
      - `spf` string, required
    - `total_count` integer, required
  - `has_more` boolean, required
  - `intake_configured` boolean, required: Whether this deployment has a DMARC report intake mailbox configured. When `false` no report can ever arrive, so an empty `data` means the feature is off rather than that your domains are clean — the two are otherwise indistinguishable.
  - `next_cursor` string, nullable, required: Pass as `after` to fetch the next page. `null` on the last page.

## Other responses

- `401`: `invalid_api_key` or `invalid_session` — missing or invalid credentials.
- `403`: `scope_missing`, `project_access_denied`, or `project_disabled`.
- `422`: `validation_error` — query, path, or body parameters did not match the schema.
- `429`: `rate_limited` — see `Retry-After` and the `RateLimit` headers.
- `500`: `internal_error`.

---

[API](https://skmtc.dev/sendly/apis/sendly-api.md) · [All operations](https://skmtc.dev/sendly/apis/sendly-api/llms.txt) · [OpenAPI document](https://skmtc.dev/sendly/apis/sendly-api/revisions/ce7cfb7f7c7e?raw)