Email Authentication Integrations

Included with Email Authentication Enterprise.

1. What This Feature Does

Integrations send Email Authentication events to your own systems as they happen: a signed webhook, Splunk through its HTTP Event Collector, or Microsoft Sentinel. Each event is a report arriving, a DMARC policy change, or an alert being raised or resolved.

Delivery picks up where it stopped. If your destination is down, events wait and are sent in order once it answers again.

2. When You Should Use It

• Your security team works from a SIEM and wants DMARC alerts and policy changes there.
• You want a ticket or a chat message the moment a record stops resolving, in a system CertaDNS does not post to directly.
• You keep a history of report arrivals and policy changes alongside your other logs.

3. When You Should Not Use It

• You only want alerts in Slack or Teams. Add a channel under Settings > Notifications.
• You want report contents — sending sources, pass rates, failure reports. Events say a report arrived and its totals; read the detail with the Email Authentication API.

4. Prerequisites

• The Email Authentication Enterprise tier.
• A destination that accepts HTTPS on a public address.

5. Events

Every event has id, type, occurred_at (ISO 8601, UTC), domain, severity, title and data. Events are recorded whatever your alert settings are: those decide who is told in the dashboard and by email, not what is sent to an integration.

Delivery is at least once. Use id to ignore an event you have already received.

6. Add an Integration

1. Open Email Authentication > Integrations and click Add integration.
2. Choose the destination and fill in its settings (below).
3. Optionally tick the event types and select the domains to send. Nothing ticked means everything.
4. Click Create integration, then Test. A test event has type integration.test.

An integration sends events from the moment it is created, unless you choose Also send earlier events: the last 24 hours, 7 days or 30 days, never further back than your plan's history. To send them again later, use Resend… on the integration. Events already delivered are sent again, so your receiver should ignore an id it has seen.

Webhook

Enter an https URL. Copy the signing secret shown after creation; it is not shown again (Rotate secret issues a new one and the old one stops at once).

Each request is a POST with a JSON body {"type": "email_auth.events", "delivery_id": "…", "events": [ … ]}, up to 100 events. Verify it before trusting it:

import hmac, hashlib

def verified(secret, headers, raw_body):
    ts = headers["X-CertaDNS-Timestamp"]
    expected = hmac.new(secret.encode(), ts.encode() + b"." + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(headers["X-CertaDNS-Signature"], "v1=" + expected)

Reject a request whose timestamp is more than five minutes old. Answer with any 2xx status; anything else is retried.

Format: CertaDNS JSON or OCSF

Webhook and Splunk integrations can send events in the Open Cybersecurity Schema Framework (OCSF 1.3) instead of the CertaDNS shape:

A raised alert and its resolution share finding_info.uid (<domain>:<alert>), so your SIEM can close the finding it opened. metadata.uid is the event id, metadata.event_code its CertaDNS type, and the CertaDNS fields are under unmapped. Splunk events in OCSF use sourcetype certadns:email_auth:ocsf. Sentinel always receives the CertaDNS shape, because its table columns are set by your data collection rule.

Splunk

1. In Splunk, create an HTTP Event Collector token (Settings > Data inputs > HTTP Event Collector) and allow the index you want.
2. Enter the HEC URL — for Splunk Cloud, https://http-inputs-<stack>.splunkcloud.com; for your own Splunk, https://<host>:8088 — and the token. /services/collector/event is added for you.
3. Events arrive with sourcetype certadns:email_auth unless you set another.

Microsoft Sentinel

Events go to a custom table in your Log Analytics workspace through the Logs Ingestion API.

1. In the workspace, create a custom table CertaDNSEmailAuth_CL (DCR-based) with the columns TimeGenerated (datetime), EventId (long), EventType, Domain, Severity, Title (string) and Data (dynamic). The portal creates a data collection rule with it.
2. In Microsoft Entra ID, register an application and create a client secret.
3. On the data collection rule, give that application the Monitoring Metrics Publisher role.
4. In CertaDNS, enter the tenant ID, the application (client) ID and secret, the rule's logs ingestion endpoint (ending .ingest.monitor.azure.com), its immutable ID (dcr-…) and the stream name (Custom-CertaDNSEmailAuth_CL).

Allow a few minutes after a test before the first rows appear in the table.

7. What You See

• Each integration shows its destination, the events and domains it sends, and its state: Delivering with the last delivery time, the last error and when it retries, or Off.
• Secrets and tokens are never shown again after you save them. To change one, type a new value; leaving it blank keeps the saved one.

8. Limits

• Up to 10 integrations per account; up to 100 events per request.
• A failing destination is retried with growing gaps, up to an hour apart. After 50 failures in a row the integration is switched off and you are told; switch it back on to resume from where it stopped.
• Destinations must be https on a public address. Redirects are not followed.
• An integration stops sending if the account leaves the Enterprise tier, and resumes if it returns.

9. Common Issues and Explanations

The test fails with http_401 or http_403

Splunk: the token is wrong or not allowed on that index. Sentinel: the application is missing the Monitoring Metrics Publisher role on the rule (role assignments can take a few minutes).

The test fails with auth_failed

Sentinel could not sign in: check the tenant ID, client ID and secret, and that the secret has not expired.

The test fails with blocked

The URL is not https, or its name resolves to a private address.

Sentinel accepts the test but no rows appear

The stream name or columns do not match the rule. The stream must be the one declared in the rule, and the table must have the columns listed above.

10. Related Features

• Email Authentication API — read reports, sources and the full event history.
• DMARC Reporting — the reports the events refer to.

11. Updates and Behavior Changes

• 1 October 2026. Integrations are available: webhook, Splunk and Microsoft Sentinel.
• 1 October 2026, later. Webhook and Splunk integrations can send OCSF. An integration can send events from the last 24 hours, 7 days or 30 days, when created or later with Resend….