# Get email authentication standing for a sending domain

`GET /v1/email/inbox-insights/authentication`

Returns whether the domain's mail authenticates and who sends as the
domain: SPF and DKIM pass rates, the DMARC standing with its published
policy and a conservative ready-for-reject judgement, and a per-source
table showing every system observed sending under the domain's name,
forwarders and unidentified senders included.

The DMARC figures name their source: authoritative aggregate reporting
that covers every sender, or Google Postmaster as a fallback covering
only mail Google received. Aggregate reports arrive on reporters' own
schedules, routinely a day or more behind, so the source table names its
latest included day; label from it rather than reading the newest days'
sparseness as a regression. For a domain with neither reporting source
configured, sections report `not_configured` with a setup path, not an
error.

API-key calls require Insights preview access for your organization.

## Code samples

### TypeScript

```ts
// Requires Insights preview access for the organization.
let sendingDomain: string | undefined;
for await (const domain of bird.email.inboxInsights.domains.list({ search: "mail.example.com" })) {
  if (domain.domain === "mail.example.com") { sendingDomain = domain.domain; break; }
}
if (!sendingDomain) throw new Error("Verify mail.example.com in this workspace first");
const report = await bird.email.inboxInsights.authentication({ sending_domain: sendingDomain });
console.log(report);
```

### Python

```py
# Requires Insights preview access for the organization.
sending_domain = None
for domain in client.email.inbox_insights.domains.list(search="mail.example.com"):
    if domain.domain == "mail.example.com":
        sending_domain = domain.domain
        break
if sending_domain is None:
    raise ValueError("Verify mail.example.com in this workspace first")
report = client.email.inbox_insights.authentication(sending_domain=sending_domain)
print(report.model_dump_json())
```

### Go

```go
// Requires Insights preview access for the organization.
client, err := bird.NewClient(option.WithAPIKey(os.Getenv("BIRD_API_KEY")))
if err != nil {
	log.Fatal(err)
}
ctx := context.Background()
sendingDomain := ""
for domain, err := range client.Email.InboxInsights.Domains.List(ctx, bird.EmailInboxInsightsDomainsListParams{Search: "mail.example.com"}) {
	if err != nil {
		log.Fatal(err)
	}
	if domain.Domain != nil && *domain.Domain == "mail.example.com" {
		sendingDomain = *domain.Domain
		break
	}
}
if sendingDomain == "" {
	log.Fatal("Verify mail.example.com in this workspace first")
}
report, err := client.Email.InboxInsights.Authentication(ctx, bird.EmailInboxInsightsAuthenticationParams{SendingDomain: sendingDomain})
if err != nil {
	log.Fatal(err)
}
encoded, err := json.MarshalIndent(report, "", "  ")
if err != nil {
	log.Fatal(err)
}
fmt.Println(string(encoded))
```

### PHP

```php
// Requires Insights preview access for the organization.
$sendingDomain = null;
foreach ($bird->email->inboxInsights->domains->list(['search' => 'mail.example.com']) as $domain) {
    if ($domain->getDomain() === 'mail.example.com') {
        $sendingDomain = $domain->getDomain();
        break;
    }
}
if ($sendingDomain === null) {
    throw new \RuntimeException('Verify mail.example.com in this workspace first');
}
$report = $bird->email->inboxInsights->authentication(['sending_domain' => $sendingDomain]);
var_dump($report);
```

### CLI

```sh
bird email inbox-insights authentication <sending-domain>
```

### cURL

```sh
curl -X GET "https://us1.platform.bird.com/v1/email/inbox-insights/authentication" \
  -H "Authorization: Bearer $TOKEN" \
  --url-query "sending_domain=mail.acme.com"
```

## Example response `200`

```json
{
  "resource": "placement",
  "domain": "mail.acme.com",
  "measurement": {
    "sources": [
      "panel",
      "intelliseed_public"
    ],
    "weighting": {
      "weight_set_id": "12",
      "source": "account",
      "basis": "weighted-mean-of-per-isp-rates"
    }
  },
  "generated_at": "2026-08-18T09:34:00Z",
  "freshness": {
    "as_of": "2026-08-17",
    "lag_hint": "daily"
  },
  "cached_at": "2026-08-18T09:40:02Z",
  "window": {
    "start": "2026-08-12",
    "end": "2026-08-18",
    "group_by": "day"
  },
  "compared_to": {
    "start": "2026-06-19",
    "end": "2026-07-18"
  },
  "spf": {
    "pass_rate_percent": 99.8,
    "delta_pts": 0.1,
    "source": "dmarc_rua",
    "status": "ok"
  },
  "dkim": {
    "pass_rate_percent": 99.8,
    "delta_pts": 0.1,
    "source": "dmarc_rua",
    "status": "ok"
  },
  "dmarc": {
    "aligned_rate_percent": 98.6,
    "policy": "quarantine",
    "ready_for_reject": false,
    "readiness_reasons": [
      "source_below_threshold"
    ],
    "delta_pts": -0.2,
    "source": "dmarc_rua",
    "status": "ok"
  },
  "sources": {
    "items": [
      {
        "name": "Bird (mail.acme.com)",
        "category": "esp",
        "volume": 4820000,
        "spf_aligned_rate_percent": 99.8,
        "dkim_aligned_rate_percent": 99.9,
        "dmarc_pass_rate_percent": 99.9,
        "verdict": "aligned",
        "qualifies_for_readiness": true
      }
    ],
    "latest_data_date": "2026-08-15",
    "status": "ok"
  }
}
```

## Query parameters

- `sending_domain` (string): The sending domain to report on: one of the workspace's verified sending domains, exactly as it appears there. A domain that is not verified in this workspace answers not-found.
- `from` (string)

  First UTC day of the period, inclusive, in YYYY-MM-DD: the same window
  convention as the email statistics endpoints. Defaults to 30 days
  before `to`.

  It may be at most 30 days before `to`, which is also the default, so a
  request naming neither date is already at the limit. Asking for more
  answers `422`: the page pairs these figures with Bird's own per-provider
  sending statistics, and those are kept for 30 days, so a longer period
  could only describe two different spans side by side.
- `to` (string): Last UTC day of the period, inclusive, in YYYY-MM-DD. Defaults to today.
- `compare` (string)

  Include the prior equal-length period, populating `compared_to`.

  Possible values: `previous_period`

## Response body

- `resource` (string, required): Which resource this response is, echoed for self-description.
- `domain` (string, required): The sending domain the figures describe.
- `measurement` (object): How the figures were measured. Present only where a figure was weighted or drawn from a named set of sources, which today means placement and the industry benchmark. Absent on the reputation resources and on a live lookup, neither of which weights anything.
- `measurement.sources` (array of string, required): Identifiers of the measurement systems that contributed to these figures. The set grows as measurement coverage does, so treat the values as labels rather than a closed list.
- `measurement.weighting` (object): How the figures were weighted. Present on figures weighted against an audience mix, which is placement's method; measurements that weight nothing carry no weighting block.
- `measurement.weighting.weight_set_id` (string, required): The measurement's own identifier for the audience mix, carried through so a client can tell two weightings apart without comparing `basis` strings. No operation accepts it.
- `measurement.weighting.source` (nullable string, required): Which audience mix the weighting used. Null when the measurement weighted these figures by a method this API does not model: the enum is closed so that a client can branch on it exhaustively, which means an unfamiliar method has to answer "not one of these" rather than be passed through. `basis` usually still describes the method in words when that happens.
- `measurement.weighting.basis` (nullable string, required): The weighting method behind the rates, as the measurement names it. A slug rather than a sentence, so render it as a label and do not expect it to read as English. Null when the measurement did not state one, which pairs with `source`: both describe the method, so neither can claim to know it when the measurement was silent.
- `generated_at` (string, required): When the measurement service computed these figures.
- `freshness` (object, required): How current the figures are. Freshness differs per resource (authentication data can lag a day or more while blocklist lookups are near real time), so any "as of" label binds from this field, never from a fixed string.
- `freshness.as_of` (nullable string, required): The most recent UTC day the figures include, or null for a live lookup that has no measurement window.
- `freshness.lag_hint` (nullable string, required)

  How far behind real time this resource usually runs. A lowercase
  identifier rather than a display label, so pick your own wording for it,
  and treat the set as open: the measurement names a hint per resource and
  can add one without notice.

  Null when the measurement reports no hint, which several resources do:
  show the figures without an age rather than inventing one.

  Possible values (may grow over time): `daily`, `nightly`, `near_real_time`
- `cached_at` (string): Present when the response was served from a short-lived copy rather than fetched for this request: when that copy was fetched.
- `window` (object, required)

  The period every figure in the response covers: whole UTC calendar days,
  inclusive on both ends. The same window convention the email statistics
  endpoints use, so figures from the two sources describe the same days and
  can be combined without adjustment.
- `window.start` (string, required): First UTC day of the period, inclusive.
- `window.end` (string, required): Last UTC day of the period, inclusive.
- `window.group_by` (string)

  The bucket size any series in this response is grouped by. Absent on resources with no series.

  Possible values: `day`, `week`, `month`
- `compared_to` (object): The prior equal-length period the delta figures compare against. Present only when the request asked for a comparison.
- `compared_to.start` (string, required): First UTC day of the prior period, inclusive.
- `compared_to.end` (string, required): Last UTC day of the prior period, inclusive.
- `spf` (object, required): The domain's SPF pass rate.
- `spf.pass_rate_percent` (nullable number, required): Share of the domain's measured mail that passed this check, as a percentage.
- `spf.delta_pts` (number): How the pass rate moved against the prior period, in percentage points. Present only when the request asked for a comparison and the prior period had data; absence is not zero change.
- `spf.source` (nullable string, required)

  Where this figure comes from. `dmarc_rua` is authoritative aggregate
  reporting and covers every sender of the domain, forwarders included;
  `google_postmaster` is a fallback covering only mail Google received. It
  can differ from the source of the DMARC figures, so surface it per check
  rather than once per response.

  Null on a check that reports no figure at all, which is what a
  `not_configured` status means: there is no measurement, so there is no
  source to name.

  Possible values (may grow over time): `dmarc_rua`, `google_postmaster`
- `spf.status` (string, required)

  Whether a section of the response carries figures, and when it does not, why.

  `ok` means the section is populated. `no_data` means the measurement ran and
  observed nothing to report for this domain in the period. `not_configured`
  means the section needs a setup step that has not been completed yet, such as
  connecting Google Postmaster Tools; treat it as an invitation to finish
  setup rather than a fault. `unavailable` means the figures could not be retrieved this time and
  the same request may well succeed on a retry; the rest of the response is
  unaffected. `not_applicable` means the section is meaningless for this domain
  in this period, so there is nothing to show or fix.

  A successful response never implies every section is populated; read each
  section's status rather than assuming figures are present.

  Possible values: `ok`, `no_data`, `not_configured`, `unavailable`, `not_applicable`
- `dkim` (object, required): The domain's DKIM pass rate.
- `dkim.pass_rate_percent` (nullable number, required): Share of the domain's measured mail that passed this check, as a percentage.
- `dkim.delta_pts` (number): How the pass rate moved against the prior period, in percentage points. Present only when the request asked for a comparison and the prior period had data; absence is not zero change.
- `dkim.source` (nullable string, required)

  Where this figure comes from. `dmarc_rua` is authoritative aggregate
  reporting and covers every sender of the domain, forwarders included;
  `google_postmaster` is a fallback covering only mail Google received. It
  can differ from the source of the DMARC figures, so surface it per check
  rather than once per response.

  Null on a check that reports no figure at all, which is what a
  `not_configured` status means: there is no measurement, so there is no
  source to name.

  Possible values (may grow over time): `dmarc_rua`, `google_postmaster`
- `dkim.status` (string, required)

  Whether a section of the response carries figures, and when it does not, why.

  `ok` means the section is populated. `no_data` means the measurement ran and
  observed nothing to report for this domain in the period. `not_configured`
  means the section needs a setup step that has not been completed yet, such as
  connecting Google Postmaster Tools; treat it as an invitation to finish
  setup rather than a fault. `unavailable` means the figures could not be retrieved this time and
  the same request may well succeed on a retry; the rest of the response is
  unaffected. `not_applicable` means the section is meaningless for this domain
  in this period, so there is nothing to show or fix.

  A successful response never implies every section is populated; read each
  section's status rather than assuming figures are present.

  Possible values: `ok`, `no_data`, `not_configured`, `unavailable`, `not_applicable`
- `dmarc` (object, required): The domain's DMARC standing over the period.
- `dmarc.aligned_rate_percent` (nullable number, required): Share of the domain's measured mail that passed DMARC alignment, as a percentage.
- `dmarc.policy` (nullable string, required): The policy published in the domain's DNS record, or null when the domain publishes no DMARC record at all. Null is not `none`: `none` is a policy, asking receivers to take no action while the domain monitors its reporting, and a domain that has one is already set up. A null asks for a record to be published, which is a different first step.
- `dmarc.ready_for_reject` (nullable boolean, required): Whether the domain's authentication is consistent enough to move the policy to `reject` without losing legitimate mail. Deliberately conservative: false whenever the data is insufficient to be sure. Null when the measurement reached no verdict, which is what a `status` other than `ok` means here: false would read as a considered "not yet" rather than as no assessment having been made.
- `dmarc.readiness_reasons` (nullable array, required): Why `ready_for_reject` is false, so the answer is actionable rather than a bare refusal. Empty when nothing is holding the domain back, and null when readiness was not assessed, which pairs with `ready_for_reject`: an empty list alongside a null verdict would say the opposite of what was measured. Render these rather than a plain "not ready": the fix differs per reason, and a domain held back only by stale reporting needs no configuration change at all.
- `dmarc.delta_pts` (number): How the aligned rate moved against the prior period, in percentage points. Present only when the request asked for a comparison and the prior period had data; absence is not zero change.
- `dmarc.source` (nullable string, required)

  Where the DMARC figures come from. `dmarc_rua` is authoritative
  aggregate reporting and covers every sender of the domain, forwarders
  included; `google_postmaster` is a fallback covering only mail Google
  received. The two are not equivalent, so surface which one is shown.

  Null when the section reports no figures, which is what a
  `not_configured` status means for a domain with no aggregate reporting
  and no Postmaster connection.

  Possible values (may grow over time): `dmarc_rua`, `google_postmaster`
- `dmarc.status` (string, required)

  Whether a section of the response carries figures, and when it does not, why.

  `ok` means the section is populated. `no_data` means the measurement ran and
  observed nothing to report for this domain in the period. `not_configured`
  means the section needs a setup step that has not been completed yet, such as
  connecting Google Postmaster Tools; treat it as an invitation to finish
  setup rather than a fault. `unavailable` means the figures could not be retrieved this time and
  the same request may well succeed on a retry; the rest of the response is
  unaffected. `not_applicable` means the section is meaningless for this domain
  in this period, so there is nothing to show or fix.

  A successful response never implies every section is populated; read each
  section's status rather than assuming figures are present.

  Possible values: `ok`, `no_data`, `not_configured`, `unavailable`, `not_applicable`
- `sources` (object, required): Every system observed sending as this domain, with how each authenticates. This is the table that shows who else sends under the domain's name.
- `sources.items` (array of object, required): One row per observed sending source.
- `sources.items.name` (string, required): The sending source as the reporting identifies it. Not a fixed list: unidentified senders, mostly forwarders, appear as a real category.
- `sources.items.category` (nullable string, required)

  A coarse classification of the source. The set can grow; treat values as labels. Null when the measurement did not classify this sender.

  Possible values (may grow over time): `esp`, `unknown`
- `sources.items.volume` (integer, required): Messages the reporting attributes to this source over the period.
- `sources.items.spf_aligned_rate_percent` (nullable number, required): Share of this source's mail that passed SPF with alignment, as a percentage.
- `sources.items.dkim_aligned_rate_percent` (nullable number, required): Share of this source's mail that passed DKIM with alignment, as a percentage.
- `sources.items.dmarc_pass_rate_percent` (nullable number, required): Share of this source's mail that passed DMARC, as a percentage.
- `sources.items.verdict` (string, required)

  How a sending source's mail authenticates against the domain's DMARC policy. `aligned` passes with both SPF and DKIM aligned; `dkim_only` and `spf_only` pass on one mechanism; `fails_policy` passes neither. The reporting decides this set and can add to it, so treat an unrecognised value as a label to show rather than a case to exhaust. A source whose verdict is new still belongs in the table.

  Possible values (may grow over time): `aligned`, `dkim_only`, `spf_only`, `fails_policy`
- `sources.items.qualifies_for_readiness` (boolean, required): Whether this source counts toward the reject recommendation. A source that does not is excluded from that judgement, which is what lets this table explain a conservative recommendation instead of contradicting it.
- `sources.latest_data_date` (nullable string, required): The most recent UTC day the source reporting includes. Aggregate DMARC reports arrive on reporters' own schedules, routinely a day or more behind, so the newest days look sparse; label from this date rather than treating the dip as a regression.
- `sources.status` (string, required)

  Whether a section of the response carries figures, and when it does not, why.

  `ok` means the section is populated. `no_data` means the measurement ran and
  observed nothing to report for this domain in the period. `not_configured`
  means the section needs a setup step that has not been completed yet, such as
  connecting Google Postmaster Tools; treat it as an invitation to finish
  setup rather than a fault. `unavailable` means the figures could not be retrieved this time and
  the same request may well succeed on a retry; the rest of the response is
  unaffected. `not_applicable` means the section is meaningless for this domain
  in this period, so there is nothing to show or fix.

  A successful response never implies every section is populated; read each
  section's status rather than assuming figures are present.

  Possible values: `ok`, `no_data`, `not_configured`, `unavailable`, `not_applicable`

## Related resources

- [Should I use a Bird SDK or call the API directly?](/explained/platform/should-i-use-an-sdk-or-call-the-api-directly) (answer)
- [Build your first integration](/learn/paths/integration) (course)
- [Send your first email](/docs/get-started/send-your-first-email) (docs)

[Get an implementation brief](/learn/workspace?topic=api-basics)