21 June 2026 · 3 min read
Yes. DMARC Engine ships with a REST API so you can manage authentication and pull reporting data from your own scripts, CI pipelines, provisioning tools or internal dashboards rather than clicking through the UI. The API speaks JSON over HTTPS and uses API-key authentication, so it slots into the same workflows you already use for the rest of your infrastructure.
You authenticate with a scoped API key. Sign in to the dashboard at app.dmarcengine.com, open Settings -> API keys (creating keys is an admin-only action), and generate a key. Each key is shown once at creation and is stored only as a SHA-256 hash, so copy it straight into your secret store. You can issue multiple keys (for example one per environment or per integration), label them so you know what each is for, and revoke any key instantly if it leaks or is no longer needed. Send the key in the x-api-key request header on every request:
curl https://app.dmarcengine.com/api/domains \
-H "x-api-key: YOUR_API_KEY"Here is what you can automate through the API:
- Records and onboarding: add and remove domains, read the DMARC, SPF, DKIM, MTA-STS and BIMI state we manage for each one, and check live publication status. Because we host the records behind a delegated CNAME, you do not push raw DNS through the API; you change policy and configuration, and we propagate it. This is how teams onboard a batch of domains programmatically instead of one at a time.
- Reporting: retrieve the parsed aggregate (RUA) data that normally appears in the dashboard, broken down by sending source, authentication result and pass or fail volume. You can export this on a schedule into your own data warehouse or BI tool, or feed it into a customer-facing report. See /tools/dmarc-report-analyzer for the same parsing logic in an interactive view.
- Alerts and monitoring: poll for the alert events we raise (for example a new unauthenticated source, a drop in pass rate, or a record that has stopped resolving) so you can route them into your own on-call tooling. We do not send inbound webhooks, but you can also have alerts pushed automatically to the outbound notification channels configured in Settings -> Notifications (Email, Slack, a generic HTTPS webhook and PagerDuty) alongside polling the API.
A few practical notes. Keys are scoped to your account, so requests are tied to the same domains you manage in the dashboard. The REST endpoints live under https://app.dmarcengine.com/api/* (for example /api/domains, /api/lookup, /api/reports and /api/settings/api-keys); there is no separate API host and no version namespace in the path. For automation that needs to react to changes, poll the relevant endpoint rather than expecting a callback. Reporting data is only as fresh as the reports your sources send, which for most mailbox providers means roughly daily aggregate reports, so polling more often than once an hour for report data gives you nothing new.
For the full endpoint list, request and response shapes, authentication details and example payloads, documentation is available on request. If you are still deciding whether to drive everything by API or let us run it for you hands-off, the /products/managed-dmarc overview explains the done-for-you path, and you can always mix the two: let us handle the safe progression from p=none to p=reject while your scripts read reporting and alert data through the API. If you need a capability that is not yet exposed, tell us what you are trying to build and we will tell you whether it is on the roadmap.