Query fact rows
query_recordsQuery day-aggregated DMARC fact rows to drill into a source IP, domain, day, or alignment outcome, and continue truncated results with a cursor.
Instructions
Day-aggregated fact rows. Use this to drill into one IP, day, or alignment outcome. Does not follow pagination: when truncated is true, pass next_cursor back as cursor. The cursor carries the filters, so the follow-up does not need to restate them. Rows are narrowed and third-party strings are length-capped.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| day | No | Exact day, YYYY-MM-DD. | |
| cursor | No | next_cursor from a previous truncated response. | |
| domain | No | ||
| day_after | No | ||
| source_ip | No | Exact sending IP. | |
| day_before | No | ||
| disposition | No | ||
| header_from | No | Substring of the From domain. | |
| spf_aligned | No | ||
| dkim_aligned | No | ||
| reporter_org | No | Substring of the reporter name. | |
| source_ip_asn | No | ||
| source_ip_name | No | Substring of the sender label. | |
| source_ip_as_name | No | Substring of the AS name. | |
| source_ip_country | No | ISO 3166-1 alpha-2. |