Skip to content
Cloudflare API
Start here
API Reference

Email Auth

Email AuthDMARC Reports

Get DMARC Report Status
email_auth.dmarc_reports.get(DMARCReportGetParams**kwargs) -> DMARCReportGetResponse
GET/zones/{zone_id}/email/auth/dmarc-reports
Configure DMARC Reports
email_auth.dmarc_reports.edit(DMARCReportEditParams**kwargs) -> DMARCReportEditResponse
PATCH/zones/{zone_id}/email/auth/dmarc-reports
ModelsExpand Collapse
class DMARCReportGetResponse: …

Response for GET/PATCH /dmarc-reports

approved_sources: Optional[List[ApprovedSource]]

List of approved sending sources (omitted when empty)

Deprecatedcreated: Optional[datetime]

Use created_at instead.

Deprecated, use created_at

formatdate-time
created_at: Optional[datetime]

Creation timestamp

formatdate-time
domain: Optional[str]

The source domain

ips: Optional[List[str]]

Resolved IP addresses from SPF

Deprecatedmodified: Optional[datetime]

Use modified_at instead.

Deprecated, use modified_at

formatdate-time
modified_at: Optional[datetime]

Last modification timestamp

formatdate-time
name: Optional[str]

Source name (typically same as domain)

slug: Optional[str]

URL-friendly identifier

tag: Optional[str]

Source UUID

Deprecatedcreated: Optional[datetime]

Use created_at instead.

Deprecated, use created_at

formatdate-time
created_at: Optional[datetime]

Creation timestamp

formatdate-time
enabled: Optional[bool]

Whether DMARC reports are enabled

Deprecatedmodified: Optional[datetime]

Use modified_at instead.

Deprecated, use modified_at

formatdate-time
modified_at: Optional[datetime]

Last modification timestamp

formatdate-time
records: Optional[Records]

Live DNS records for the zone, grouped by type

bimi_records: Optional[List[RecordsBimiRecord]]

BIMI TXT records

id: Optional[str]

DNS record ID

content: Optional[str]

Record content

name: Optional[str]

DNS record name

ttl: Optional[int]

Time to live in seconds

type: Optional[str]

Record type

cname_dkim_records: Optional[List[RecordsCnamedkimRecord]]

CNAME records for DKIM

id: Optional[str]

DNS record ID

content: Optional[str]

Record content

name: Optional[str]

DNS record name

ttl: Optional[int]

Time to live in seconds

type: Optional[str]

Record type

cname_dmarc_records: Optional[List[RecordsCnamedmarcRecord]]

CNAME records at _dmarc (problematic)

id: Optional[str]

DNS record ID

content: Optional[str]

Record content

name: Optional[str]

DNS record name

ttl: Optional[int]

Time to live in seconds

type: Optional[str]

Record type

cname_spf_records: Optional[List[RecordsCnamespfRecord]]

CNAME records for SPF

id: Optional[str]

DNS record ID

content: Optional[str]

Record content

name: Optional[str]

DNS record name

ttl: Optional[int]

Time to live in seconds

type: Optional[str]

Record type

dkim_records: Optional[List[RecordsDKIMRecord]]

DKIM TXT records

id: Optional[str]

DNS record ID

content: Optional[str]

Record content

name: Optional[str]

DNS record name

ttl: Optional[int]

Time to live in seconds

type: Optional[str]

Record type

dmarc_records: Optional[List[RecordsDMARCRecord]]

DMARC TXT records

id: Optional[str]

DNS record ID

content: Optional[str]

Record content

name: Optional[str]

DNS record name

ttl: Optional[int]

Time to live in seconds

type: Optional[str]

Record type

spf_records: Optional[List[RecordsSPFRecord]]

SPF TXT records

id: Optional[str]

DNS record ID

content: Optional[str]

Record content

name: Optional[str]

DNS record name

ttl: Optional[int]

Time to live in seconds

type: Optional[str]

Record type

rua_prefix: Optional[str]

Prefix for DMARC RUA addresses (32-char hex string)

skip_wizard: Optional[bool]

Whether to skip the setup wizard

status: Optional[Literal["missing-dmarc-report", "multiple-dmarc-reports", "missing-dmarc-rua", "cname-on-dmarc-record"]]

DMARC configuration status

One of the following:
"missing-dmarc-report"
"multiple-dmarc-reports"
"missing-dmarc-rua"
"cname-on-dmarc-record"
Deprecatedtag: Optional[str]

Use zone_id instead.

Use zone_id instead

zone_id: Optional[str]

Zone identifier

class DMARCReportEditResponse: …

Response for GET/PATCH /dmarc-reports

approved_sources: Optional[List[ApprovedSource]]

List of approved sending sources (omitted when empty)

Deprecatedcreated: Optional[datetime]

Use created_at instead.

Deprecated, use created_at

formatdate-time
created_at: Optional[datetime]

Creation timestamp

formatdate-time
domain: Optional[str]

The source domain

ips: Optional[List[str]]

Resolved IP addresses from SPF

Deprecatedmodified: Optional[datetime]

Use modified_at instead.

Deprecated, use modified_at

formatdate-time
modified_at: Optional[datetime]

Last modification timestamp

formatdate-time
name: Optional[str]

Source name (typically same as domain)

slug: Optional[str]

URL-friendly identifier

tag: Optional[str]

Source UUID

Deprecatedcreated: Optional[datetime]

Use created_at instead.

Deprecated, use created_at

formatdate-time
created_at: Optional[datetime]

Creation timestamp

formatdate-time
enabled: Optional[bool]

Whether DMARC reports are enabled

Deprecatedmodified: Optional[datetime]

Use modified_at instead.

Deprecated, use modified_at

formatdate-time
modified_at: Optional[datetime]

Last modification timestamp

formatdate-time
records: Optional[Records]

Live DNS records for the zone, grouped by type

bimi_records: Optional[List[RecordsBimiRecord]]

BIMI TXT records

id: Optional[str]

DNS record ID

content: Optional[str]

Record content

name: Optional[str]

DNS record name

ttl: Optional[int]

Time to live in seconds

type: Optional[str]

Record type

cname_dkim_records: Optional[List[RecordsCnamedkimRecord]]

CNAME records for DKIM

id: Optional[str]

DNS record ID

content: Optional[str]

Record content

name: Optional[str]

DNS record name

ttl: Optional[int]

Time to live in seconds

type: Optional[str]

Record type

cname_dmarc_records: Optional[List[RecordsCnamedmarcRecord]]

CNAME records at _dmarc (problematic)

id: Optional[str]

DNS record ID

content: Optional[str]

Record content

name: Optional[str]

DNS record name

ttl: Optional[int]

Time to live in seconds

type: Optional[str]

Record type

cname_spf_records: Optional[List[RecordsCnamespfRecord]]

CNAME records for SPF

id: Optional[str]

DNS record ID

content: Optional[str]

Record content

name: Optional[str]

DNS record name

ttl: Optional[int]

Time to live in seconds

type: Optional[str]

Record type

dkim_records: Optional[List[RecordsDKIMRecord]]

DKIM TXT records

id: Optional[str]

DNS record ID

content: Optional[str]

Record content

name: Optional[str]

DNS record name

ttl: Optional[int]

Time to live in seconds

type: Optional[str]

Record type

dmarc_records: Optional[List[RecordsDMARCRecord]]

DMARC TXT records

id: Optional[str]

DNS record ID

content: Optional[str]

Record content

name: Optional[str]

DNS record name

ttl: Optional[int]

Time to live in seconds

type: Optional[str]

Record type

spf_records: Optional[List[RecordsSPFRecord]]

SPF TXT records

id: Optional[str]

DNS record ID

content: Optional[str]

Record content

name: Optional[str]

DNS record name

ttl: Optional[int]

Time to live in seconds

type: Optional[str]

Record type

rua_prefix: Optional[str]

Prefix for DMARC RUA addresses (32-char hex string)

skip_wizard: Optional[bool]

Whether to skip the setup wizard

status: Optional[Literal["missing-dmarc-report", "multiple-dmarc-reports", "missing-dmarc-rua", "cname-on-dmarc-record"]]

DMARC configuration status

One of the following:
"missing-dmarc-report"
"multiple-dmarc-reports"
"missing-dmarc-rua"
"cname-on-dmarc-record"
Deprecatedtag: Optional[str]

Use zone_id instead.

Use zone_id instead

zone_id: Optional[str]

Zone identifier

Email AuthSPF

Email AuthSPFInspect

Inspect SPF Record
email_auth.spf.inspect.get(InspectGetParams**kwargs) -> InspectGetResponse
GET/zones/{zone_id}/email/auth/spf/inspect
ModelsExpand Collapse
class InspectGetResponse: …

Recursive SPF inspection tree

components: List[object]

Parsed SPF components (mechanisms)

domain: str

Domain being inspected

record: str

Raw SPF record content

total_lookups: int

Total number of DNS lookups performed across all includes

errors: Optional[List[Error]]

All errors encountered during inspection, collected from the entire tree. This includes errors from nested includes at any depth, providing a quick overview of all issues without needing to traverse the nested structure. Each error includes a domain field to identify where it occurred. Empty array if no errors (omitted from JSON when empty).

code: str

Error code. Known values:

  • lookup_failed — DNS TXT lookup failed
  • spf_not_found — no SPF record found
  • invalid_spf — record does not start with v=spf1
  • invalid_domain — PSL validation failed
  • loop_detected — include/redirect cycle detected
  • invalid_mechanism — unrecognised or malformed mechanism
  • resource_limit_exceeded — internal resource protection limits exceeded (recursion depth or query budget)
  • max_lookups — RFC 7208 10-lookup limit exceeded
domain: str

Domain where the error occurred

message: str

Human-readable error message

details: Optional[str]

Additional error-specific details (optional).

  • For invalid_domain errors: the invalid domain string
  • For invalid_mechanism errors: the invalid mechanism text (e.g., “invalidmech123”)
  • For loop_detected errors: the domain that caused the loop
  • For other error types: not present