DMARC reports

List who sends mail as our domains

GET/api/v1/dmarc/sources

Who can use this: Site adminsAs Markdown

One row per sending address and domain, the most failing mail first, 500 rows at most. An address that isn't one of ours, sending mail that fails, is someone else using the domain's name.

Parameters

Name	Where	What it is
days	query	How many days back to look. 30 if you leave it out.
domain	query	Only this domain.
failing	query	1 for only the addresses with some failing mail.

curl -s 'https://api.mailmasker.org/api/v1/dmarc/sources' \
  -H "Authorization: Bearer $TOKEN"

use Mojo::Base -strict;
use Mojo::UserAgent;

my $ua  = Mojo::UserAgent->new;
my $res = $ua->get('https://api.mailmasker.org/api/v1/dmarc/sources',
    { Authorization => "Bearer $ENV{TOKEN}" })->result;
die $res->code, ' ', ($res->json('/error') // $res->message), "\n" unless $res->is_success;
print $res->body, "\n";

There's no homelab-cli command for this yet.

Response 200 OK

{
  "days": 30,
  "domain": null,
  "sources": [
    {
      "source_ip": "203.0.113.77",
      "domain": "example.com",
      "messages": 9,
      "aligned": 0,
      "failing": 9,
      "reporters": 1,
      "last_seen": "2026-11-02 17:59:59-06"
    },
    {
      "source_ip": "192.0.2.25",
      "domain": "example.com",
      "messages": 1281,
      "aligned": 1281,
      "failing": 0,
      "reporters": 4,
      "last_seen": "2026-11-03 17:59:59-06"
    }
  ]
}