--- title: Email Auth --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api/python) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Email Auth #### Email AuthDMARC Reports ##### [Get DMARC Report Status](https://developers.cloudflare.com/api/python/resources/email_auth/subresources/dmarc_reports/methods/get) email\_auth.dmarc\_reports.get(DMARCReportGetParams\*\*kwargs) -> [DMARCReportGetResponse]() GET/zones/{zone\_id}/email/auth/dmarc-reports ##### [Configure DMARC Reports](https://developers.cloudflare.com/api/python/resources/email_auth/subresources/dmarc_reports/methods/edit) email\_auth.dmarc\_reports.edit(DMARCReportEditParams\*\*kwargs) -> [DMARCReportEditResponse]() PATCH/zones/{zone\_id}/email/auth/dmarc-reports ##### ModelsExpand Collapse

class DMARCReportGetResponse: … Response for GET/PATCH /dmarc-reports

approved\_sources: Optional\[List\[ApprovedSource]] List of approved sending sources (omitted when empty)

Deprecatedcreated: Optional\[datetime] Use created_at instead. Deprecated, use created\_at formatdate-time Link to this property created\_at: Optional\[datetime] Creation timestamp formatdate-time Link to this property domain: Optional\[str] The source domain Link to this property ips: Optional\[List\[str]] Resolved IP addresses from SPF Link to this property Deprecatedmodified: Optional\[datetime] Use modified_at instead. Deprecated, use modified\_at formatdate-time Link to this property modified\_at: Optional\[datetime] Last modification timestamp formatdate-time Link to this property name: Optional\[str] Source name (typically same as domain) Link to this property slug: Optional\[str] URL-friendly identifier Link to this property tag: Optional\[str] Source UUID Link to this property

Link to this property Deprecatedcreated: Optional\[datetime] Use created_at instead. Deprecated, use created\_at formatdate-time Link to this property created\_at: Optional\[datetime] Creation timestamp formatdate-time Link to this property enabled: Optional\[bool] Whether DMARC reports are enabled Link to this property Deprecatedmodified: Optional\[datetime] Use modified_at instead. Deprecated, use modified\_at formatdate-time Link to this property modified\_at: Optional\[datetime] Last modification timestamp formatdate-time Link to this property

records: Optional\[Records] Live DNS records for the zone, grouped by type

bimi\_records: Optional\[List\[RecordsBimiRecord]] BIMI TXT records

id: Optional\[str] DNS record ID Link to this property content: Optional\[str] Record content Link to this property name: Optional\[str] DNS record name Link to this property resolved: Optional\[List\[str]] For a CNAME record, the TXT content(s) found by following the CNAME chain to its target. An empty array means the chain was resolved but nothing usable was found there; omitted/null means resolution was not attempted for this record (always the case for non-CNAME entries). A CNAME chain that terminates in more than one TXT value at the target yields multiple entries. Populated on entries in cname\_dmarc\_records, cname\_spf\_records, and cname\_dkim\_records. Link to this property ttl: Optional\[int] Time to live in seconds Link to this property type: Optional\[str] Record type Link to this property

Link to this property

cname\_dkim\_records: Optional\[List\[RecordsCnamedkimRecord]] CNAME records for DKIM selectors. Each selector is resolved independently; when a selector’s CNAME resolves to a DKIM TXT record, the API returns that record’s content in the resolved field of the corresponding entry.

Link to this property

cname\_dmarc\_records: Optional\[List\[RecordsCnamedmarcRecord]] CNAME records at \_dmarc. When such a CNAME resolves to a DMARC TXT record, the API returns that record’s content in the resolved field of the corresponding entry.

Link to this property

cname\_spf\_records: Optional\[List\[RecordsCnamespfRecord]] CNAME records at the zone apex. When such a CNAME resolves to an SPF TXT record, the API returns that record’s content in the resolved field of the corresponding entry.

Link to this property

dkim\_records: Optional\[List\[RecordsDKIMRecord]] DKIM TXT records

Link to this property

dmarc\_records: Optional\[List\[RecordsDMARCRecord]] DMARC TXT records

Link to this property

Deprecatedresolved\_dmarc\_records: Optional\[List\[RecordsResolvedDMARCRecord]] Use the resolved field on the corresponding entry in cname\_dmarc\_records instead. DMARC records that a recursive lookup of \_dmarc.{zone} returned. The API populates this only when the zone lacks a DMARC TXT record of its own, which usually means a CNAME delegates DMARC to another zone.

content: Optional\[str] The TXT record value. The API joins all character-strings into a single string. Link to this property name: Optional\[str] The name the API queried. Link to this property

Link to this property

spf\_records: Optional\[List\[RecordsSPFRecord]] SPF TXT records

Link to this property

Link to this property rua\_prefix: Optional\[str] Prefix for DMARC RUA addresses (32-char hex string) Link to this property skip\_wizard: Optional\[bool] Whether to skip the setup wizard Link to this property

status: Optional\[Literal\["missing-dmarc-report", "multiple-dmarc-reports", "missing-dmarc-rua", 2 more]] DMARC configuration status. The API omits this field when DMARC is correctly configured. If the zone lacks a DMARC TXT record of its own, the API resolves \_dmarc.{zone} recursively and evaluates whatever that lookup returns. A CNAME at \_dmarc.{zone} that points to a valid DMARC record is therefore healthy; the cname-on-dmarc-record value means the CNAME resolves to no DMARC record at all.

One of the following: "missing-dmarc-report" Link to this property "multiple-dmarc-reports" Link to this property "missing-dmarc-rua" Link to this property "cname-on-dmarc-record" Link to this property "unauthorized-reporting-domain" Link to this property

Link to this property Deprecatedtag: Optional\[str] Use zone_id instead. Use zone_id instead Link to this property zone\_id: Optional\[str] Zone identifier Link to this property

[Link to this property](<#(resource)%20email_auth.dmarc_reports%20%3E%20(model)%20dmarc_report_get_response%20%3E%20(schema)>)

class DMARCReportEditResponse: … Response for GET/PATCH /dmarc-reports

approved\_sources: Optional\[List\[ApprovedSource]] List of approved sending sources (omitted when empty)

records: Optional\[Records] Live DNS records for the zone, grouped by type

bimi\_records: Optional\[List\[RecordsBimiRecord]] BIMI TXT records

Link to this property

dkim\_records: Optional\[List\[RecordsDKIMRecord]] DKIM TXT records

Link to this property

dmarc\_records: Optional\[List\[RecordsDMARCRecord]] DMARC TXT records

Link to this property

content: Optional\[str] The TXT record value. The API joins all character-strings into a single string. Link to this property name: Optional\[str] The name the API queried. Link to this property

Link to this property

spf\_records: Optional\[List\[RecordsSPFRecord]] SPF TXT records

Link to this property

Link to this property Deprecatedtag: Optional\[str] Use zone_id instead. Use zone_id instead Link to this property zone\_id: Optional\[str] Zone identifier Link to this property

[Link to this property](<#(resource)%20email_auth.dmarc_reports%20%3E%20(model)%20dmarc_report_edit_response%20%3E%20(schema)>) #### Email AuthSPF #### Email AuthSPFInspect ##### [Inspect SPF Record](https://developers.cloudflare.com/api/python/resources/email_auth/subresources/spf/subresources/inspect/methods/get) email\_auth.spf.inspect.get(InspectGetParams\*\*kwargs) -> [InspectGetResponse]() GET/zones/{zone\_id}/email/auth/spf/inspect ##### ModelsExpand Collapse

class InspectGetResponse: … Recursive SPF inspection tree

components: List\[object] Parsed SPF components (mechanisms) Link to this property domain: str Domain being inspected Link to this property record: str Raw SPF record content Link to this property total\_lookups: int Total number of DNS lookups performed across all includes Link to this property

errors: Optional\[List\[Error]] All errors encountered during inspection, collected from the entire tree. This includes errors from nested includes at any depth, providing a quick overview of all issues without needing to traverse the nested structure. Each error includes a domain field to identify where it occurred. Empty array if no errors (omitted from JSON when empty).

code: str Error code. Known values: - lookup_failed — DNS TXT lookup failed - spf_not_found — no SPF record found - invalid_spf — record does not start with v=spf1 - invalid_domain — PSL validation failed - loop_detected — include/redirect cycle detected - invalid_mechanism — unrecognised or malformed mechanism - resource_limit_exceeded — internal resource protection limits exceeded (recursion depth or query budget) - max_lookups — RFC 7208 10-lookup limit exceeded Link to this property domain: str Domain where the error occurred Link to this property message: str Human-readable error message Link to this property details: Optional\[str] Additional error-specific details (optional). - For invalid_domain errors: the invalid domain string - For invalid_mechanism errors: the invalid mechanism text (e.g., “invalidmech123”) - For loop_detected errors: the domain that caused the loop - For other error types: not present Link to this property

Link to this property

[Link to this property](<#(resource)%20email_auth.spf.inspect%20%3E%20(model)%20inspect_get_response%20%3E%20(schema)>)