dmarcian

Overview

dmarcian is a DMARC/SPF/DKIM/BIMI/TLS-RPT email-authentication monitoring platform. It ingests DMARC aggregate (RUA) reports for your domains and surfaces compliance posture, sending sources (including shadow IT), and remediation issues.

The Bumblebee integration is read-only: it can query domains and their compliance posture, domain groups, issues, sending sources, policy readiness, DKIM selectors, and forensic report jobs, and can inspect or validate published email-authentication records. It does not change your dmarcian configuration.

This integration is a research preview.

Prerequisites & Setup

Before setting up the dmarcian integration, you need:

• A dmarcian account on the Enterprise plan (the REST API is an Enterprise-tier feature)
• An API token generated from your dmarcian account
• The base URL for your dmarcian cloud (US by default)

Generate an API token

1. Sign in to dmarcian as an administrator
2. Open Preferences and select the API Key tab
3. Generate an API token and copy it

Regenerating the token immediately revokes the previous one. If a token is already in use elsewhere, generate from a dedicated service account instead.

If you restrict the token by IP (dmarcian's Authorized Token IPs), Bumblebee's egress IP must be on the allowlist or every request is rejected with a 4xx.

Configure in Bumblebee

1. Go to the Integrations page in Bumblebee
2. Select dmarcian
3. Enter your API Token
4. Set the Base URL — leave it as https://us.dmarcian.com for the US cloud, use https://eu.dmarcian.com for the EU cloud, or your own host for a self-hosted instance
5. Save the configuration
6. Run a test request (e.g. query domains) from the validation card

Authentication

dmarcian uses a token scheme (not Bearer): requests send an Authorization: Token {api_token} header. The token and base URL are the only credentials Bumblebee stores.

API Limits

List endpoints are paginated with page (1-based) and limit; responses carry results, count, and _links.

Available Tools

Domains & groups (2 tools)

• query_domains — List DMARC-monitored domains and compliance posture, or fetch one by id. Optional: domain_id (fetch one), domain, domain_exact, domain_state (active/inactive/unknown), group_id, has_errors, is_verified, last_seen_dmarc_policy, treat_as_top_level, ordering, page, limit. last_seen_dmarc_policy is the primary compliance signal (n=none, q=quarantine, r=reject, x=no record, e=error; on/oq/or=seen via the organizational domain).
• query_domain_groups — List domain groups, or fetch one by id. Optional: group_id (fetch one), label, domain_state, search, search_exact, page, limit.

Issues (1 tool)

• query_issues — List the remediation issue backlog, or fetch one by id. Optional: issue_id (fetch one), solved, ignored, created_after, created_before, group_id, domain, domain_state, assigned_to_group, top_level, ordering, page, limit.

Sources & policy readiness (2 tools)

• query_sources — Query sending sources seen in DMARC reports (including shadow IT). Optional: view (sources default, source_domains, or filters), filter_id, source_number, page, limit.
• query_policy_domains — Query DMARC policy readiness per domain. Optional: view (domains default or filters), policy_ready (find domains ready to advance policy, e.g. toward p=reject), recommendation, filter_id, page, limit.

Record inspectors (2 tools)

These work on any public domain — they query DNS, not your account data.

• inspect_published_record — Inspect a domain's published DMARC/SPF/DKIM/BIMI DNS record. Required: record_type (dmarc/spf/dkim/bimi), domain. Optional: selector (required when record_type is dkim).
• validate_record_string — Validate a raw DMARC or DKIM record string before publishing. Required: record_type (dmarc/dkim), record.

DKIM selectors & forensics (2 tools)

• query_dkim_selectors — List discovered DKIM selectors, or fetch one by id. Optional: selector_id (fetch one), domain, ordering, page, limit.
• query_forensic_reports — Query forensic (DMARC failure / RUF) report jobs and their data. Optional: job_id (fetch one job), search_token (fetch a job's forensic data), page, limit. Forensic data is message-level and privacy-sensitive (subjects, headers, sometimes recipient addresses) — fetch only when an investigation needs it.