--- title: Email Auth --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api/typescript) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Email Auth #### Email AuthDMARC Reports ##### [Get DMARC Report Status](https://developers.cloudflare.com/api/typescript/resources/email_auth/subresources/dmarc_reports/methods/get) client.emailAuth.dmarcReports.get(DMARCReportGetParams {zone\_id } params, RequestOptionsoptions?): [DMARCReportGetResponse]() {approved\_sources, created, created\_at, 9 more } GET/zones/{zone\_id}/email/auth/dmarc-reports ##### [Configure DMARC Reports](https://developers.cloudflare.com/api/typescript/resources/email_auth/subresources/dmarc_reports/methods/edit) client.emailAuth.dmarcReports.edit(DMARCReportEditParams {zone\_id, enabled, skip\_wizard } params, RequestOptionsoptions?): [DMARCReportEditResponse]() {approved\_sources, created, created\_at, 9 more } PATCH/zones/{zone\_id}/email/auth/dmarc-reports ##### ModelsExpand Collapse

DMARCReportGetResponse {approved\_sources, created, created\_at, 9 more } Response for GET/PATCH /dmarc-reports

approved\_sources?: Array<ApprovedSource> List of approved sending sources (omitted when empty)

Deprecatedcreated?: string Use created_at instead. Deprecated, use created\_at formatdate-time Link to this property created\_at?: string Creation timestamp formatdate-time Link to this property domain?: string The source domain Link to this property ips?: Array<string> Resolved IP addresses from SPF Link to this property Deprecatedmodified?: string Use modified_at instead. Deprecated, use modified\_at formatdate-time Link to this property modified\_at?: string Last modification timestamp formatdate-time Link to this property name?: string Source name (typically same as domain) Link to this property slug?: string URL-friendly identifier Link to this property tag?: string Source UUID Link to this property

Link to this property Deprecatedcreated?: string Use created_at instead. Deprecated, use created\_at formatdate-time Link to this property created\_at?: string Creation timestamp formatdate-time Link to this property enabled?: boolean Whether DMARC reports are enabled Link to this property Deprecatedmodified?: string Use modified_at instead. Deprecated, use modified\_at formatdate-time Link to this property modified\_at?: string Last modification timestamp formatdate-time Link to this property

records?: Records {bimi\_records, cname\_dkim\_records, cname\_dmarc\_records, 5 more } Live DNS records for the zone, grouped by type

bimi\_records?: Array<BimiRecord> BIMI TXT records

id?: string DNS record ID Link to this property content?: string Record content Link to this property name?: string DNS record name Link to this property resolved?: Array<string>| null For a CNAME record, the TXT content(s) found by following the CNAME chain to its target. An empty array means the chain was resolved but nothing usable was found there; omitted/null means resolution was not attempted for this record (always the case for non-CNAME entries). A CNAME chain that terminates in more than one TXT value at the target yields multiple entries. Populated on entries in cname\_dmarc\_records, cname\_spf\_records, and cname\_dkim\_records. Link to this property ttl?: number Time to live in seconds Link to this property type?: string Record type Link to this property

Link to this property

cname\_dkim\_records?: Array<CnamedkimRecord> CNAME records for DKIM selectors. Each selector is resolved independently; when a selector’s CNAME resolves to a DKIM TXT record, the API returns that record’s content in the resolved field of the corresponding entry.

Link to this property

cname\_dmarc\_records?: Array<CnamedmarcRecord> CNAME records at \_dmarc. When such a CNAME resolves to a DMARC TXT record, the API returns that record’s content in the resolved field of the corresponding entry.

Link to this property

cname\_spf\_records?: Array<CnamespfRecord> CNAME records at the zone apex. When such a CNAME resolves to an SPF TXT record, the API returns that record’s content in the resolved field of the corresponding entry.

Link to this property

dkim\_records?: Array<DKIMRecord> DKIM TXT records

Link to this property

dmarc\_records?: Array<DMARCRecord> DMARC TXT records

Link to this property

Deprecatedresolved\_dmarc\_records?: Array<ResolvedDMARCRecord> Use the resolved field on the corresponding entry in cname\_dmarc\_records instead. DMARC records that a recursive lookup of \_dmarc.{zone} returned. The API populates this only when the zone lacks a DMARC TXT record of its own, which usually means a CNAME delegates DMARC to another zone.

content?: string The TXT record value. The API joins all character-strings into a single string. Link to this property name?: string The name the API queried. Link to this property

Link to this property

spf\_records?: Array<SPFRecord> SPF TXT records

Link to this property

Link to this property rua\_prefix?: string Prefix for DMARC RUA addresses (32-char hex string) Link to this property skip\_wizard?: boolean Whether to skip the setup wizard Link to this property

status?: "missing-dmarc-report"| "multiple-dmarc-reports"| "missing-dmarc-rua"| 2 more DMARC configuration status. The API omits this field when DMARC is correctly configured. If the zone lacks a DMARC TXT record of its own, the API resolves \_dmarc.{zone} recursively and evaluates whatever that lookup returns. A CNAME at \_dmarc.{zone} that points to a valid DMARC record is therefore healthy; the cname-on-dmarc-record value means the CNAME resolves to no DMARC record at all.

One of the following: "missing-dmarc-report" Link to this property "multiple-dmarc-reports" Link to this property "missing-dmarc-rua" Link to this property "cname-on-dmarc-record" Link to this property "unauthorized-reporting-domain" Link to this property

Link to this property Deprecatedtag?: string Use zone_id instead. Use zone_id instead Link to this property zone\_id?: string Zone identifier Link to this property

[Link to this property](<#(resource)%20email_auth.dmarc_reports%20%3E%20(model)%20dmarc_report_get_response%20%3E%20(schema)>)

DMARCReportEditResponse {approved\_sources, created, created\_at, 9 more } Response for GET/PATCH /dmarc-reports

approved\_sources?: Array<ApprovedSource> List of approved sending sources (omitted when empty)

records?: Records {bimi\_records, cname\_dkim\_records, cname\_dmarc\_records, 5 more } Live DNS records for the zone, grouped by type

bimi\_records?: Array<BimiRecord> BIMI TXT records

Link to this property

dkim\_records?: Array<DKIMRecord> DKIM TXT records

Link to this property

dmarc\_records?: Array<DMARCRecord> DMARC TXT records

Link to this property

content?: string The TXT record value. The API joins all character-strings into a single string. Link to this property name?: string The name the API queried. Link to this property

Link to this property

spf\_records?: Array<SPFRecord> SPF TXT records

Link to this property

Link to this property rua\_prefix?: string Prefix for DMARC RUA addresses (32-char hex string) Link to this property skip\_wizard?: boolean Whether to skip the setup wizard Link to this property

Link to this property Deprecatedtag?: string Use zone_id instead. Use zone_id instead Link to this property zone\_id?: string Zone identifier Link to this property

[Link to this property](<#(resource)%20email_auth.dmarc_reports%20%3E%20(model)%20dmarc_report_edit_response%20%3E%20(schema)>) #### Email AuthSPF #### Email AuthSPFInspect ##### [Inspect SPF Record](https://developers.cloudflare.com/api/typescript/resources/email_auth/subresources/spf/subresources/inspect/methods/get) client.emailAuth.spf.inspect.get(InspectGetParams {zone\_id, id } params, RequestOptionsoptions?): [InspectGetResponse]() {components, domain, record, 2 more } GET/zones/{zone\_id}/email/auth/spf/inspect ##### ModelsExpand Collapse

InspectGetResponse {components, domain, record, 2 more } Recursive SPF inspection tree

components: Array<unknown> Parsed SPF components (mechanisms) Link to this property domain: string Domain being inspected Link to this property record: string Raw SPF record content Link to this property total\_lookups: number Total number of DNS lookups performed across all includes Link to this property

errors?: Array<Error> All errors encountered during inspection, collected from the entire tree. This includes errors from nested includes at any depth, providing a quick overview of all issues without needing to traverse the nested structure. Each error includes a domain field to identify where it occurred. Empty array if no errors (omitted from JSON when empty).

code: string Error code. Known values: - lookup_failed — DNS TXT lookup failed - spf_not_found — no SPF record found - invalid_spf — record does not start with v=spf1 - invalid_domain — PSL validation failed - loop_detected — include/redirect cycle detected - invalid_mechanism — unrecognised or malformed mechanism - resource_limit_exceeded — internal resource protection limits exceeded (recursion depth or query budget) - max_lookups — RFC 7208 10-lookup limit exceeded Link to this property domain: string Domain where the error occurred Link to this property message: string Human-readable error message Link to this property details?: string Additional error-specific details (optional). - For invalid_domain errors: the invalid domain string - For invalid_mechanism errors: the invalid mechanism text (e.g., “invalidmech123”) - For loop_detected errors: the domain that caused the loop - For other error types: not present Link to this property

Link to this property

[Link to this property](<#(resource)%20email_auth.spf.inspect%20%3E%20(model)%20inspect_get_response%20%3E%20(schema)>)