How to Flag DMARC Alignment Failures with an API

DMARC alignment determines whether the domain visible to recipients in the From address matches the domain authenticated by SPF or DKIM. A message can pass one authentication test yet fail DMARC alignment, leaving Australian organisations exposed to impersonation, phishing and delivery problems.

Trusted Sender Score provides a practical way to add domain trust checks to security workflows. By connecting its API to mail gateways, identity systems, monitoring tools or deployment pipelines, a team can identify domains that need attention before a spoofing campaign develops.

The useful trigger is often an operational event: a new domain is registered, a marketing platform is connected, a sender changes, or a customer-facing service begins sending mail. A spoofing protection guide can help security teams understand the wider risks before automating checks.

For organisations operating across Sydney, Melbourne, Brisbane or regional Australia, this approach can support consistent controls across .au domains and third-party senders. It is especially valuable where teams work across Australian Eastern, Central and Western time zones and cannot rely on manual checks during every change window.

Understand what an alignment failure means

DMARC evaluates the visible From domain against either the SPF-authenticated envelope-from domain or the DKIM signing domain. With relaxed alignment, related organisational domains may match; strict alignment requires an exact match. A domain fails DMARC when neither SPF nor DKIM both passes and aligns with the From domain.

The API should therefore be used to flag risk, not to treat every authentication result as identical. A DKIM pass with an unrelated signing domain may still fail DMARC. Likewise, SPF can pass for a sending provider while the message presented to recipients uses a different domain.

Before writing integration logic, define the policy your organisation wants to enforce. A bank, university or government supplier may require strict alignment for important mail, while a small retailer may begin with relaxed alignment and progressively tighten its policy.

Prepare access and domain ownership

Create an API credential through the platform’s supported account process and keep it in a secrets manager rather than source code, spreadsheets or shared chat. Use a dedicated service identity with the smallest practical permissions, and rotate its key according to your internal security schedule.

Domain ownership also matters. An administrator may need to validate control of a domain before its reputation or authentication information can be managed. The domain admin instructions explain the relevant access path for Trusted Sender Score users.

Create a small inventory containing the From domains your business uses, authorised sending services, business owner, environment and risk rating. Include customer portals, newsletters, invoices and recruitment systems, as these are commonly overlooked when teams focus only on the corporate website.

Call the API from the right workflow

Use the platform’s API documentation to confirm the authentication method, endpoint paths, request schema, response fields, rate limits and error codes. A typical request sends a domain for verification and receives trust or authentication findings. Treat the following as a pattern rather than a copy-and-paste endpoint:

POST /domain-check
Authorization: Bearer <service-token>
{
  "domain": "example.com.au",
  "alignment": "strict"
}

Your application should extract the result for SPF, DKIM, DMARC and alignment separately. Store the request time, domain, environment, result and correlation ID, while avoiding unnecessary retention of message content or personal information.

The platform usage guide is useful when mapping the API into an existing workflow. Build an explicit rule such as: flag the domain when DMARC is absent, the policy is weak, or both SPF and DKIM fail to align with the visible From domain.

Turn checks into real-time alerts

A real-time design usually means checking at the point of change, rather than waiting for a weekly spreadsheet review. Trigger an API call when a domain is added to a mail platform, a DNS record changes, a new sender is approved or a deployment modifies email configuration.

For high-volume systems, place checks behind a queue and cache results for a short period. Apply exponential backoff for rate-limit responses, set timeouts, and prevent one unavailable API call from blocking legitimate business mail. Send a clear alert to the responsible team with the affected domain, failed alignment path and recommended owner.

API checks reveal the current domain posture, while DMARC aggregate reports show what receiving mail systems are observing in practice. Combine both signals where possible. This helps identify a service that appears correctly configured in DNS but sends with an unexpected From domain.

Triage failures without creating noise

Use severity levels. A production domain with p=none, no aligned DKIM and an active bulk sender deserves faster attention than a dormant test domain. A newly observed vendor should be quarantined for review, while a known provider with a temporary DNS issue may receive a monitored warning.

Do not automatically change DNS policy after one failed result. Confirm the intended sender, inspect SPF lookup limits, check DKIM selector configuration and verify that the visible From address is the approved domain. Australian organisations should also consider privacy obligations when logs contain employee, customer or supplier addresses.

Record remediation steps and retest after DNS propagation. A useful audit trail shows who approved the sender, which authentication mechanism aligned, when the issue cleared and whether the domain was checked from the correct environment.

Compare response actions by result

A compact decision model keeps automation predictable. The response should distinguish configuration weaknesses from an active spoofing concern, and it should route the issue to a person who owns the domain or sending service.

API or DMARC finding	Risk interpretation	Recommended automated action
DMARC missing	Recipients have limited policy guidance	Create a high-priority configuration ticket
DMARC present but neither SPF nor DKIM aligns	Messages may fail DMARC or be impersonated	Alert the domain owner and pause new sender approval
DKIM aligns and SPF fails	A sender path may be incomplete	Warn the service owner and verify SPF authorisation
SPF aligns and DKIM fails	Signing may be absent or misconfigured	Request DKIM selector review and retest
Both SPF and DKIM align	Stronger authentication posture	Record a pass and continue monitoring
Strict alignment fails but relaxed alignment passes	Exact domain matching is inconsistent	Review whether strict mode is required for that use case

After deployment, measure alert volume, time to remediation, recurring vendors and repeated failures by domain. These metrics help security teams improve sender inventories without weakening the control. A well-designed API integration turns DMARC alignment from an occasional DNS task into a continuous trust signal for Australian email operations.