List top sending sources (ESPs, ISPs, mail services) for a domain, grouped by source type.
Filters: "known" (legitimate ESPs like Google, Mailgun), "unknown" (unrecognized senders), "forward" (forwarding services). Empty = all types.
Returns the top 20 of each type with message volume and SPF/DKIM/DMARC pass/fail counts.
group_by picks what a row stands for:
• "provider" (default) — one row per ESP/ISP, the sending landscape at a glance.
• "domain" — one row per sending domain (ip_domain_name, falling back to the provider's brand and then to its name). Use it when one provider hosts several senders and the question is which of them sends: an ESP whose customers each get their own hostname, or unknown traffic spread over many hosts of the same cloud.
Row identity is in groupKey; isp, brandDomain, sender and ipDomainName describe it. domainsCount / providersCount / ipCount say how many distinct sending domains, providers and IPs the row covers — in provider mode a large domainsCount is the signal to switch to group_by=domain.
With group_by=domain each row also carries its place in the domain's readiness plan, matched on groupKey — the source key:
• decision — the user's live call on the source: ours, not_ours or ignore; null for none.
• planRole — blocker (holds the plan's next step: the next policy, or taking pct off a record that has it — get_enforcement_status's nextStep and pct), confirmation (unattributed: the user has to call it not theirs) or excluded (looks like the domain's own, but the user took it out); null when the step does not depend on the source.
• verdict — the engine's call on the source's mail: aligned, needs_dkim, relay, unattributed, inactive or low_volume. A decision never changes it: "ours" does not authenticate mail. With a next step, needs_dkim and planRole null is a recommendation, a source too small to hold the step (get_enforcement_status lists it in info.spfOnly or info.smallNotAligned).
• decisionPending — true while the plan has yet to take the decision in, or its removal (within about a minute of a change); null when the plan does not list the source or is not current (the header says so, get_enforcement_status why).
planRole and verdict are the plan's, from the same evaluation whatever the period asked for and whatever the plan's windowDays is — its own last 14 days, with the step's window (28 days for a step to reject, and at reject) for the DKIM rule (a source that sent only in the 28 days before them is inactive, or aligned when windowDays is 28 and those days find it aligned); the header says when it was evaluated and whether it is still current. A row with neither is not in the plan. group_by=provider carries none of these: a provider row covers several sources.
The table keeps the 20 largest rows of each type, so a blocker or a source to confirm can be missing from it: get_enforcement_status lists them all, with the plan's verdict.
Use this to investigate WHERE email is being sent from — especially when unknown sources appear or compliance is low.
To drill down into a specific source (by IP, ISP, hostname, or reporter), use get_domain_source_details.
