> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rad.security/llms.txt
> Use this file to discover all available pages before exploring further.

# EasyDMARC

> Configure the EasyDMARC integration with RAD Security to ingest DMARC domain posture, aggregate (RUA) reports, and failure (RUF) reports.

# EasyDMARC Integration Setup

This guide walks you through integrating EasyDMARC with RAD Security to ingest your DMARC posture and email-authentication telemetry for external attack-surface and email-security analysis.

EasyDMARC is an email-authentication (DMARC/SPF/DKIM) platform. RAD Security connects to the EasyDMARC API and pulls your monitored domains and DMARC reports on a scheduled basis. It complements the registration/DNS providers in Domain Security (CSC Global, DNS Made Easy) by adding deep DMARC reporting on top of domain posture.

<Info>
  **Read-only integration:** RAD Security only reads data from EasyDMARC. It never creates, modifies, or deletes domains, DNS records, or reports in your account.
</Info>

## Prerequisites

Before you begin, ensure you have:

<Check>
  * An EasyDMARC account with **API access enabled** (the Public API is plan-gated and may require enabling by EasyDMARC)
  * Ability to generate a **Client ID** and **Secret Key** for API access
  * Your EasyDMARC **Organization ID** (format `org_...`), from the EasyDMARC admin console / organization URL
  * Access to a RAD Security workspace with integration permissions
</Check>

<Warning>
  **API access is plan-gated:** EasyDMARC's API is available on paid tiers and may need to be enabled for your account. If API access is not enabled, the integration cannot connect — enable Public API / API access in EasyDMARC first.
</Warning>

## Understanding Integration Components

<AccordionGroup>
  <Accordion title="Client ID + Secret Key" icon="key">
    RAD Security authenticates with an EasyDMARC **Client ID** and **Secret Key** using the OAuth2 client-credentials flow. You supply both; RAD exchanges them for a short-lived bearer token and refreshes it automatically.
  </Accordion>

  <Accordion title="Aggregate (RUA) Reports" icon="chart-column">
    RUA reports are aggregated statistics of who is sending email on behalf of your domains and how that mail authenticated (SPF/DKIM) and was dispositioned (none/quarantine/reject). They contain **no message content** and no personal data.
  </Accordion>

  <Accordion title="Failure (RUF) Reports" icon="triangle-exclamation">
    RUF (forensic) reports describe individual messages that failed authentication. They can contain **message-level personal data** (sender, recipient, subject). RUF ingestion is **opt-in** and off by default; when enabled, RAD hashes sender/recipient addresses and redacts the subject before storing anything.
  </Accordion>
</AccordionGroup>

***

## Step 1: Generate API Credentials in EasyDMARC

<Steps>
  <Step title="Sign in to EasyDMARC">
    Log in to your EasyDMARC account with an administrator.
  </Step>

  <Step title="Enable and open API access">
    Navigate to the API access section of your account settings. If API access is not available, follow the prompt to enable it (this may require a plan with API access or contacting EasyDMARC).
  </Step>

  <Step title="Generate Client ID and Secret Key">
    Generate your **Client ID** and **Secret Key**.

    <Warning>
      Copy the **Secret Key** immediately and store it securely in a password manager or secrets vault. You will need both values to configure the integration.
    </Warning>
  </Step>

  <Step title="Note your Organization ID">
    Find your **Organization ID** (format `org_...`) in the EasyDMARC admin console or your organization URL. Every domain and report query is scoped to it, so the integration cannot connect without it.
  </Step>
</Steps>

<Note>
  Exact account navigation and labels may vary. See the [EasyDMARC developer documentation](https://developers.easydmarc.com/) for the current steps to enable API access and generate credentials.
</Note>

***

## Configure in RAD Security

Navigate to your RAD Security workspace and configure the EasyDMARC integration with the following parameters:

### Required Parameters

| Parameter           | Description                                                                                   |
| ------------------- | --------------------------------------------------------------------------------------------- |
| **Client ID**       | EasyDMARC API Client ID                                                                       |
| **Secret Key**      | EasyDMARC API Secret Key, used to mint short-lived API tokens                                 |
| **Organization ID** | EasyDMARC Organization ID (format `org_...`). All domain and report queries are scoped to it. |

### Optional Parameters

| Parameter                        | Description                                                                                                                                                                           |
| -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Ingest failure reports (RUF)** | Also ingest forensic failure reports. These carry message-level PII (sender, recipient, subject); RAD hashes addresses and redacts subjects before storage. Boolean; **default off**. |

<Note>
  RAD Security handles token exchange and refresh automatically — you provide the Client ID, Secret Key, and Organization ID.
</Note>

***

## Verify Integration

<Steps>
  <Step title="Check Connection Status">
    1. Navigate to **Data Sources > Integrations > Domain Security** in RAD Security
    2. Locate your EasyDMARC integration
    3. Verify the connection status shows as **Connected**
  </Step>
</Steps>

<Check>
  Your EasyDMARC integration is now configured! RAD Security will ingest your DMARC domain posture and aggregate reports on a scheduled basis (and failure reports if you enabled them).
</Check>

## What Data is Synced

<AccordionGroup>
  <Accordion title="Domain Posture" icon="globe">
    * Monitored domains as domain assets
    * DMARC/SPF/DKIM presence and the DMARC enforcement policy (none/quarantine/reject)
  </Accordion>

  <Accordion title="Aggregate (RUA) Reports" icon="chart-column">
    * Per-sending-source authentication outcomes (SPF/DKIM results, disposition, volume)
    * A finding is raised for authentication failures (for example, unauthenticated senders or a non-enforcing policy on a domain receiving failing mail)
  </Accordion>

  <Accordion title="Failure (RUF) Reports — opt-in" icon="triangle-exclamation">
    * Individual failed-message reports, with sender/recipient hashed and subject redacted
    * A finding is raised per failure report
  </Accordion>
</AccordionGroup>

<Note>
  On first connection RAD backfills recent DMARC reports, then syncs **incrementally** (only new reports each cycle), bounded by your EasyDMARC plan's report retention. Domain posture is refreshed each cycle.
</Note>

## Use Cases

<CardGroup cols={2}>
  <Card title="Email Authentication Posture" icon="envelope-circle-check">
    Track DMARC/SPF/DKIM coverage and enforcement policy across your domains.
  </Card>

  <Card title="Spoofing & Abuse Detection" icon="user-secret">
    Surface unauthenticated senders and spoofing attempts from aggregate reports.
  </Card>

  <Card title="Enforcement Rollout" icon="gauge-high">
    Monitor progress toward p=quarantine/reject without breaking legitimate mail.
  </Card>

  <Card title="Attack Surface Analysis" icon="diagram-project">
    Combine DMARC posture with domain and DNS data for a fuller external view.
  </Card>
</CardGroup>

<Note>
  EasyDMARC focuses on email authentication. Pair it with [CSC Global](/rad-security/integrations/domain-security/csc-global-setup) and [DNS Made Easy](/rad-security/integrations/domain-security/dns-made-easy-setup) for registration, TLS, and operational DNS coverage.
</Note>

## Troubleshooting

<AccordionGroup>
  <Accordion title="API Access Not Enabled" icon="lock">
    **Possible causes:**

    * The account does not have API/Public API access enabled

    **Solution:**

    * Enable Public API / API access in EasyDMARC (this may require a plan with API access or contacting EasyDMARC), then re-verify
  </Accordion>

  <Accordion title="Authentication Failed" icon="triangle-exclamation">
    **Possible causes:**

    * Incorrect Client ID or Secret Key

    **Solution:**

    * Verify both values are copied correctly (no extra spaces)
    * Regenerate the credentials in EasyDMARC and update them in RAD Security
  </Accordion>

  <Accordion title="Request Rejected (wrong Organization ID)" icon="hashtag">
    **Possible causes:**

    * The credentials are valid (the token was issued) but the **Organization ID** is missing or wrong, so EasyDMARC rejects the data request

    **Solution:**

    * Confirm the **Organization ID** (format `org_...`) matches the EasyDMARC organization these credentials belong to, then re-verify
  </Accordion>

  <Accordion title="No Failure Reports" icon="inbox">
    **Possible causes:**

    * RUF ingestion is off (default), or there are no failure reports in the window

    **Solution:**

    * Enable **Ingest failure reports (RUF)** in the integration settings if you want forensic reports
    * Confirm your EasyDMARC account is receiving RUF reports for the domains
  </Accordion>

  <Accordion title="Empty Results" icon="inbox">
    **Possible causes:**

    * The account has no monitored domains or no reports in the recent window

    **Solution:**

    * Confirm the account has domains configured and is receiving DMARC reports in EasyDMARC
  </Accordion>
</AccordionGroup>

## Security Best Practices

<CardGroup cols={2}>
  <Card title="Use a Service Account" icon="user-gear">
    Generate API credentials under a dedicated account rather than a personal login.
  </Card>

  <Card title="Rotate Credentials" icon="rotate">
    Regenerate the Client ID and Secret Key periodically according to your security policy.
  </Card>

  <Card title="Secure Storage" icon="vault">
    Store the Secret Key in a secrets vault. Never commit it to version control.
  </Card>

  <Card title="Treat RUF as Sensitive" icon="user-shield">
    Enable failure-report (RUF) ingestion only when needed; RAD hashes addresses and redacts subjects, but RUF is inherently more sensitive than RUA.
  </Card>
</CardGroup>

## Additional Resources

<CardGroup cols={2}>
  <Card title="EasyDMARC Developer Docs" icon="book" href="https://developers.easydmarc.com/">
    Official EasyDMARC API documentation
  </Card>

  <Card title="Domain Security Overview" icon="globe" href="/rad-security/integrations/domain-security/overview">
    Learn about RAD's domain security integrations
  </Card>
</CardGroup>

## Next Steps

<CardGroup cols={2}>
  <Card title="CSC Global Setup" icon="globe" href="/rad-security/integrations/domain-security/csc-global-setup">
    Add domain registration and TLS coverage with CSC Global
  </Card>

  <Card title="DNS Made Easy Setup" icon="server" href="/rad-security/integrations/domain-security/dns-made-easy-setup">
    Add operational DNS coverage with DNS Made Easy
  </Card>

  <Card title="Data Sources" icon="database" href="/rad-security/integrations/data-sources">
    Connect additional security data sources
  </Card>
</CardGroup>