Forensic reports
List, Search and Paginate the Failure Reports. Plus get all the details of an individual Aggregate Report.

Supported Formats

json
>>>

GET api.dmarcreport.com/v1/domains/:domain_id/forensic_reports.json
List, Search and Paginate Failure Reports

Supported Formats

json

Errors

Code Description
401 Unauthorized
404 Not Found
500 Server crashed for some reason

Examples

{
  "reports": [
    {
      "id": 1,
      "domain_id": 1,
      "raw_report": "Feedback-Type: auth-failure\r\nUser-Agent: Lua/1.0\r\nVersion: 1.0\r\nOriginal-Mail-From:\r\nOriginal-Rcpt-To: recipient@linkedin.com\r\nArrival-Date: Tue, 30 Apr 2019 02:09:00 +0000\r\nMessage-ID: <01010101010101010101010101010101@ABAB01MS0016.someserver.loc>\r\nAuthentication-Results: dmarc=fail (p=none; dis=none) header.from=example.com\r\nSource-IP: 10.10.10.10\r\nDelivery-Result: delivered\r\nAuth-Failure: dmarc\r\nReported-Domain: example.com\r\n",
      "raw_original_message": "Content-Type: message/rfc822\r\nContent-Transfer-Encoding: 7bit\r\nContent-Disposition: inline\r\nContent-ID: <5d9f1b8165398_122d2abf602d8648805f7@Zaid-XPS-13.mail>\r\n\r\nReturn-Path: <>\r\nAuthentication-Results: mail516.prod.linkedin.com; iprev=pass policy.iprev=\"10.10.10.10\"; spf=neutral smtp.mailfrom=\"\" smtp.helo=\"mail02.someserver.com\"; dkim=none (message not signed) header.d=none; tls=pass (verified) key.ciphersuite=\"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\" key.length=\"256\" tls.v=\"tlsv1.2\" cert.client=\"OU=Domain Control Validated,CN=*.someserver.com\" cert.clientissuer=\"C=GB,ST=Greater Manchester,L=Salford,O=COMODO CA Limited,CN=COMODO RSA Domain Validation Secure Server CA\"; dmarc=fail (p=none; dis=none) header.from=example.com\r\nX-OnPremExternalIP: 10.10.10.10\r\nReceived: from [10.10.10.10] ([10.10.10.10:4227] helo=mail02.someserver.com)\r\n\tby mail516.prod.linkedin.com (envelope-from <>)\r\n\t(ecelerity 3.6.21.53563 r(Core:3.6.21.0)) with ESMTPS (cipher=ECDHE-RSA-AES256-GCM-SHA384\r\n\tsubject=\"/OU=Domain Control Validated/CN=*.someserver.com\")\r\n\tid CA/91-26019-ABCDECC5; Tue, 30 Apr 2019 02:09:00 +0000\r\nReceived: from DENU02MS0016.someserver.loc (10.156.68.14) by\r\n DENU02MS0017.someserver.loc (10.10.10.9) with Microsoft SMTP Server (TLS) id\r\n 15.0.1367.3; Tue, 30 Apr 2019 04:09:09 +0200\r\nReceived: from DENU02MS0016.someserver.loc ([127.0.0.1]) by\r\n DENU02MS0016.someserver.loc ([10.10.10.8]) with Microsoft SMTP Server id\r\n 15.00.1367.000; Tue, 30 Apr 2019 04:09:09 +0200\r\nFrom: Sender <sender@example.com>\r\nTo: LinkedIn <recipient@linkedin.com>\r\nSubject: Subject line, could be UTF8 encoded\r\nThread-Topic: Thread Topic line, could be UTF8 encoded\r\nThread-Index: AQHU/abcdW8+abcdLkClF52hP4alIaZT9XGh\r\nDate: Tue, 30 Apr 2019 02:09:09 +0000\r\nMessage-ID: <01010101010101010101010101010101@ABAB01MS0016.someserver.loc>\r\nReferences: <1111111111.1111111.1111111111111.JavaMail.app@lor1-app3586.prod.linkedin.com>\r\nIn-Reply-To: <1111111111.1111111.1111111111111.JavaMail.app@lor1-app3586.prod.linkedin.com>\r\nX-MS-Has-Attach:\r\nX-Auto-Response-Suppress: All\r\nX-MS-Exchange-Inbox-Rules-Loop: sender@example.com\r\nX-MS-TNEF-Correlator:\r\nx-ms-exchange-transport-fromentityheader: Hosted\r\nx-ms-exchange-parent-message-id: <1111111111.1111111.1111111111111.JavaMail.app@lor1-app3586.prod.linkedin.com>\r\nauto-submitted: auto-generated\r\nx-ms-exchange-generated-message-source: Mailbox Rules Agent\r\nx-exclaimer-md-config: 11111111-1111-1111-1111-111111111111\r\nContent-Type: multipart/alternative;\r\n\tboundary=\"_000_0d00000000000000000d000000000000f00000s00000someserverloc_\"\r\nMIME-Version: 1.0\r\nX-Linkedin-fe: false\r\n\r\n--_000_0d00000000000000000d000000000000f00000s00000someserverloc_\r\nContent-Type: text/plain; charset=\"iso-8859-1\"\r\nContent-Transfer-Encoding: quoted-printable\r\n\r\nAlternative\r\nText\r\n\r\n--_000_0d00000000000000000d000000000000f00000s00000someserverloc_\r\nContent-Type: text/html; charset=\"iso-8859-1\"\r\nContent-Transfer-Encoding: quoted-printable\r\n\r\n<html>\r\n<head>\r\n</head>\r\n<body>\r\nHTML Text\r\n</body>\r\n</html>\r\n\r\n--_000_0d00000000000000000d000000000000f00000s00000someserverloc_--",
      "subject": "Subject line, could be UTF8 encoded",
      "feedback_type": "abuse",
      "user_agent": "Lua/1.0",
      "auth_failure": "",
      "arrival_date": "2019-04-30T02:09:09.000Z",
      "from_address": "sender@example.com",
      "message_id": "<01010101010101010101010101010101@ABAB01MS0016.someserver.loc>",
      "delivery_result": "delivered",
      "original_rcpt_to": "recipient@linkedin.com",
      "reporting_mta": "",
      "reported_domain": "example.com",
      "reported_uri": "",
      "removal_recipient": "",
      "created_at": "2019-10-10T11:52:33.522Z",
      "updated_at": "2020-01-16T09:37:38.319Z",
      "report_email_message_id": null,
      "original_message_date": null,
      "ip_address_id": 2
    },
    {
      "id": 2,
      "domain_id": 1,
      "raw_report": "Feedback-Type: auth-failure\r\nUser-Agent: NtesDmarcReporter/1.0\r\nVersion: 1\r\nOriginal-Mail-From: <bounces+1137616-c1ad-xsj399=163.com@email.entrata.com>\r\nArrival-Date: Fri, 28 Sep 2018 16:48:42 +0800\r\nSource-IP: 167.89.69.24\r\nReported-Domain: cardinal.com\r\nOriginal-Envelope-Id: N8CowEApcUPo6q1bnXlMAA--.44392S3\r\nAuthentication-Results: 163.com; dkim=pass (verify result: all signatures verified) header.d=entrata.com; spf=pass smtp.mailfrom=bounces+1137616-c1ad-xsj399=163.com@email.entrata.com\r\nDKIM-Domain: entrata.com\r\nDelivery-Result: delivered\r\nIdentity-Alignment: spf,dkim",
      "raw_original_message": "Content-Type: message/rfc822\r\nContent-Transfer-Encoding: 7bit\r\nContent-Disposition: attachment\r\n\r\nReceived: by filter1356p1mdw1.sendgrid.net with SMTP id filter1356p1mdw1-30359-5BADEAE4-E\r\n        2018-09-28 08:48:36.858842501 +0000 UTC m=+1856335.516585242\r\nReceived: from MTEzNzYxNg (unknown [198.190.14.10])\r\n\tby ismtpd0007p1las1.sendgrid.net (SG) with HTTP id oguVx1AxQayV5Sv2nYK-rA\r\n\tfor <system@entrata.com>; Fri, 28 Sep 2018 08:48:36.716 +0000 (UTC)\r\nFrom: 700 on Washington <info@cardinal.com>\r\nTo: \"redacted@163.com\" <redacted@163.com>\r\nSubject: Rent Reminder\r\nThread-Topic: Rent Reminder\r\nThread-Index: AQHUVwgr2Hz5Jp/wMEGsfVZ94P1m5Q==\r\nX-MS-Exchange-MessageSentRepresentingType: 1\r\nDate: Fri, 28 Sep 2018 04:48:39 -0400\r\nMessage-ID: <oguVx1AxQayV5Sv2nYK-rA@ismtpd0007p1las1.sendgrid.net>\r\nX-MS-Has-Attach:\r\nX-MS-TNEF-Correlator:\r\nX-MS-Exchange-Organization-RecordReviewCfmType: 0\r\nContent-Type: text/plain; charset=\"us-ascii\"\r\nMIME-Version: 1.0\r\n\r\n",
      "subject": "Rent Reminder",
      "feedback_type": "auth-failure",
      "user_agent": "NtesDmarcReporter/1.0",
      "auth_failure": "",
      "arrival_date": "2018-09-28T08:48:39.000Z",
      "from_address": "info@cardinal.com",
      "message_id": "<oguVx1AxQayV5Sv2nYK-rA@ismtpd0007p1las1.sendgrid.net>",
      "delivery_result": "delivered",
      "original_rcpt_to": "redacted@163.com",
      "reporting_mta": "",
      "reported_domain": "cardinal.com",
      "reported_uri": "",
      "removal_recipient": "",
      "created_at": "2019-10-10T11:53:21.754Z",
      "updated_at": "2020-01-16T09:37:38.294Z",
      "report_email_message_id": null,
      "original_message_date": null,
      "ip_address_id": 1
    },
    {
      "id": 3,
      "domain_id": 1,
      "raw_report": "Feedback-Type: auth-failure\r\nUser-Agent: Lua/1.0\r\nVersion: 1.0\r\nOriginal-Mail-From: sharepoint@domain.de\r\nOriginal-Rcpt-To: peter.pan@domain.de\r\nArrival-Date: Mon, 01 Oct 2018 11:20:27 +0200\r\nMessage-ID: <38.E7.30937.BD6E1BB5@ mailrelay.de>\r\nAuthentication-Results: dmarc=fail (p=none, dis=none) header.from=domain.de\r\nSource-IP: 10.10.10.10\r\nDelivery-Result: smg-policy-action\r\nAuth-Failure: dmarc\r\nReported-Domain: domain.de\r\n",
      "raw_original_message": "Content-Type: message/rfc822\r\nContent-Transfer-Encoding: 7bit\r\nContent-Disposition: inline\r\nContent-ID: <5d9f1bc7e6b7e_13b52adc5a7d0648922f0@Zaid-XPS-13.mail>\r\n\r\nReceived: from Servernameone.domain.local (Servernameone.domain.local [10.10.10.10])\r\n\tby  mailrelay.de (mail.DOMAIN.de) with SMTP id 38.E7.30937.BD6E1BB5; Mon,  1 Oct 2018 11:20:27 +0200 (CEST)\r\nDate: 01 Oct 2018 11:20:27 +0200\r\nMessage-ID: <38.E7.30937.BD6E1BB5@ mailrelay.de>\r\nTo: <peter.pan@domain.de>\r\nfrom: \"=?utf-8?B?SW50ZXJha3RpdmUgV2V0dGJld2VyYmVyLcOcYmVyc2ljaHQ=?=\" <sharepoint@domain.de>\r\nSubject: Subject\r\nMIME-Version: 1.0\r\nX-Mailer: Microsoft SharePoint Foundation 2010\r\nContent-Type: text/html; charset=utf-8\r\nContent-Transfer-Encoding: quoted-printable\r\n\r\n<html><head><base href=3D'\r\nwettbewerb' /></head><body><!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2//EN\"=\r\n><HTML><HEAD><META NAME=3D\"Generator\" CONTENT=3D\"MS Exchange Server version=\r\n 08.01.0240.003\"></html>\r\n",
      "subject": "Subject",
      "feedback_type": "auth-failure",
      "user_agent": "Lua/1.0",
      "auth_failure": "",
      "arrival_date": "2018-10-01T09:20:27.000Z",
      "from_address": "sharepoint@domain.de",
      "message_id": "<38.E7.30937.BD6E1BB5@ mailrelay.de>",
      "delivery_result": "smg-policy-action",
      "original_rcpt_to": "peter.pan@domain.de",
      "reporting_mta": "",
      "reported_domain": "domain.de",
      "reported_uri": "",
      "removal_recipient": "",
      "created_at": "2019-10-10T11:53:44.062Z",
      "updated_at": "2020-01-16T09:37:38.337Z",
      "report_email_message_id": null,
      "original_message_date": null,
      "ip_address_id": 2
    }
  ],
  "meta": {
    "total_reports": 3,
    "current_page": 1,
    "per_page": 25,
    "total_pages": 1
  }
}

Params

Param name Description
q
optional

Params for Ransack Search

Validations:

  • Must be a Hash
q[created_at_gteq]
optional

Search by date begin start

Validations:

  • Must be a String
q[created_at_lteq]
optional

Search by date begin end

Validations:

  • Must be a String
q[ip_address_country_eq]
optional

Search by country

Validations:

  • Must be a String
q[ip_address_source_ip_eq]
optional

Search by source ip

Validations:

  • Must be a String
q[delivery_result]
optional

Search by for delivery result

Validations:

  • Must be a String
q[feedback_type_eq]
optional

Search by feedback type

Validations:

  • Must be a String
q[arrival_date_eq]
optional

Search by arrival date

Validations:

  • Must be a String
q[original_message_date_eq]
optional

Search by original message date

Validations:

  • Must be a String
q[from_address_eq]
optional

Search by from address

Validations:

  • Must be a String
q[message_id_eq]
optional

Search by message id

Validations:

  • Must be a String
q[subject_cont]
optional

Search by subject cont

Validations:

  • Must be a String
page
optional

Page Number

Validations:

  • Must be a String
per
optional

Entries per page.

Validations:

  • Must be a String
>>>

GET api.dmarcreport.com/v1/domains/:domain_id/forensic_reports/:id.json
Get all the details of a Failure Report

Supported Formats

json

Errors

Code Description
401 Unauthorized
404 Not Found
500 Server crashed for some reason

Examples

{
  "id": 1,
  "domain_id": 1,
  "arrival_date": "2019-04-30T02:09:09.000Z",
  "auth_failure": "",
  "delivery_result": "delivered",
  "feedback_type": "abuse",
  "from_address": "sender@example.com",
  "original_message_date": null,
  "original_rcpt_to": "recipient@linkedin.com",
  "raw_original_message": "Content-Type: message/rfc822\r\nContent-Transfer-Encoding: 7bit\r\nContent-Disposition: inline\r\nContent-ID: <5d9f1b8165398_122d2abf602d8648805f7@Zaid-XPS-13.mail>\r\n\r\nReturn-Path: <>\r\nAuthentication-Results: mail516.prod.linkedin.com; iprev=pass policy.iprev=\"10.10.10.10\"; spf=neutral smtp.mailfrom=\"\" smtp.helo=\"mail02.someserver.com\"; dkim=none (message not signed) header.d=none; tls=pass (verified) key.ciphersuite=\"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\" key.length=\"256\" tls.v=\"tlsv1.2\" cert.client=\"OU=Domain Control Validated,CN=*.someserver.com\" cert.clientissuer=\"C=GB,ST=Greater Manchester,L=Salford,O=COMODO CA Limited,CN=COMODO RSA Domain Validation Secure Server CA\"; dmarc=fail (p=none; dis=none) header.from=example.com\r\nX-OnPremExternalIP: 10.10.10.10\r\nReceived: from [10.10.10.10] ([10.10.10.10:4227] helo=mail02.someserver.com)\r\n\tby mail516.prod.linkedin.com (envelope-from <>)\r\n\t(ecelerity 3.6.21.53563 r(Core:3.6.21.0)) with ESMTPS (cipher=ECDHE-RSA-AES256-GCM-SHA384\r\n\tsubject=\"/OU=Domain Control Validated/CN=*.someserver.com\")\r\n\tid CA/91-26019-ABCDECC5; Tue, 30 Apr 2019 02:09:00 +0000\r\nReceived: from DENU02MS0016.someserver.loc (10.156.68.14) by\r\n DENU02MS0017.someserver.loc (10.10.10.9) with Microsoft SMTP Server (TLS) id\r\n 15.0.1367.3; Tue, 30 Apr 2019 04:09:09 +0200\r\nReceived: from DENU02MS0016.someserver.loc ([127.0.0.1]) by\r\n DENU02MS0016.someserver.loc ([10.10.10.8]) with Microsoft SMTP Server id\r\n 15.00.1367.000; Tue, 30 Apr 2019 04:09:09 +0200\r\nFrom: Sender <sender@example.com>\r\nTo: LinkedIn <recipient@linkedin.com>\r\nSubject: Subject line, could be UTF8 encoded\r\nThread-Topic: Thread Topic line, could be UTF8 encoded\r\nThread-Index: AQHU/abcdW8+abcdLkClF52hP4alIaZT9XGh\r\nDate: Tue, 30 Apr 2019 02:09:09 +0000\r\nMessage-ID: <01010101010101010101010101010101@ABAB01MS0016.someserver.loc>\r\nReferences: <1111111111.1111111.1111111111111.JavaMail.app@lor1-app3586.prod.linkedin.com>\r\nIn-Reply-To: <1111111111.1111111.1111111111111.JavaMail.app@lor1-app3586.prod.linkedin.com>\r\nX-MS-Has-Attach:\r\nX-Auto-Response-Suppress: All\r\nX-MS-Exchange-Inbox-Rules-Loop: sender@example.com\r\nX-MS-TNEF-Correlator:\r\nx-ms-exchange-transport-fromentityheader: Hosted\r\nx-ms-exchange-parent-message-id: <1111111111.1111111.1111111111111.JavaMail.app@lor1-app3586.prod.linkedin.com>\r\nauto-submitted: auto-generated\r\nx-ms-exchange-generated-message-source: Mailbox Rules Agent\r\nx-exclaimer-md-config: 11111111-1111-1111-1111-111111111111\r\nContent-Type: multipart/alternative;\r\n\tboundary=\"_000_0d00000000000000000d000000000000f00000s00000someserverloc_\"\r\nMIME-Version: 1.0\r\nX-Linkedin-fe: false\r\n\r\n--_000_0d00000000000000000d000000000000f00000s00000someserverloc_\r\nContent-Type: text/plain; charset=\"iso-8859-1\"\r\nContent-Transfer-Encoding: quoted-printable\r\n\r\nAlternative\r\nText\r\n\r\n--_000_0d00000000000000000d000000000000f00000s00000someserverloc_\r\nContent-Type: text/html; charset=\"iso-8859-1\"\r\nContent-Transfer-Encoding: quoted-printable\r\n\r\n<html>\r\n<head>\r\n</head>\r\n<body>\r\nHTML Text\r\n</body>\r\n</html>\r\n\r\n--_000_0d00000000000000000d000000000000f00000s00000someserverloc_--",
  "raw_report": "Feedback-Type: auth-failure\r\nUser-Agent: Lua/1.0\r\nVersion: 1.0\r\nOriginal-Mail-From:\r\nOriginal-Rcpt-To: recipient@linkedin.com\r\nArrival-Date: Tue, 30 Apr 2019 02:09:00 +0000\r\nMessage-ID: <01010101010101010101010101010101@ABAB01MS0016.someserver.loc>\r\nAuthentication-Results: dmarc=fail (p=none; dis=none) header.from=example.com\r\nSource-IP: 10.10.10.10\r\nDelivery-Result: delivered\r\nAuth-Failure: dmarc\r\nReported-Domain: example.com\r\n",
  "removal_recipient": "",
  "reported_domain": "example.com",
  "reported_uri": "",
  "reporting_mta": "",
  "subject": "Subject line, could be UTF8 encoded",
  "user_agent": "Lua/1.0",
  "message_id": "<01010101010101010101010101010101@ABAB01MS0016.someserver.loc>",
  "report_email_message_id": null,
  "created_at": "2019-10-10T11:52:33.522Z",
  "updated_at": "2020-01-16T09:37:38.319Z",
  "ip_address": {
    "id": 2,
    "sane_source_ip": "10.10.10.10",
    "blacklisted": null,
    "ptr": null,
    "country": "ro",
    "created_at": "2020-01-16T09:37:38.309Z",
    "updated_at": "2020-01-16T09:37:38.323Z"
  }
}