Connect EasyDMARC

EasyDMARC is an email-authentication platform. It receives the DMARC reports that mailbox providers send about your clients' domains, checks and generates SPF, DKIM, DMARC, BIMI, MTA-STS and TLS-RPT records, watches DNS for changes, and gives an MSP one console for every client domain. StackJack talks to it through the EasyDMARC public API, the same interface EasyDMARC documents for integrations.

Connecting EasyDMARC to StackJack gives your AI assistant a family of easydmarc_ MCP tools. MCP (Model Context Protocol) tools are the standardized commands an AI assistant can call through StackJack. With them, your AI can:

• Answer the daily DMARC questions - is a client's SPF over the ten-lookup limit, is DMARC at p=reject, does a DKIM selector resolve, is BIMI valid. Single and batch lookups for every record type, plus the parsed record structure and the record to publish
• Draft the fix - generate an MTA-STS or TLS-RPT record, build a DMARC record from a structure, and read the exact record EasyDMARC wants published for a domain
• See who is sending as a domain - the parsed aggregate (RUA) reports, with SPF and DKIM pass and fail counts, volume over time, distinct senders and countries, and pass rates, so "can we move this client to quarantine" has an answer
• Investigate a spoofing or phishing report - the forensic (RUF) reports, their statistics, and short-lived links to the original message and its attachments
• See what changed - the audit log of an organization, as a list or as a CSV file
• List the estate - an organization's domains, with their type, policy and verification state, and its domain groups

It can also make changes, on the Pro tier:

• Onboard and tidy domains - add one domain or many, move a domain between groups or to parked, add several existing domains to a group or take one out, create and rename groups, delete a retired domain
• Manage webhooks - create, update, delete and re-key the webhooks that deliver EasyDMARC events to your own systems
• Administer partner accounts - create, rename and delete client organizations, invite or create users, remove their access, assign, renew, cancel and change subscription plans, and add or remove payment methods

Reading is free. Every change needs the Pro tier, and the ones that cannot be undone, or that change what you are billed, are labelled so your AI assistant asks before running them.

What you need first

• An EasyDMARC plan with API access. API access is part of the Enterprise (Email Trust) plan and the MSP plan. The DMARC Plus, DMARC Premium and Deliverability plans cannot create API credentials.
• A partner agreement, for the partner tools only. Organizations, users, billing, plans and the partner profile belong to EasyDMARC's Partner API, which EasyDMARC provisions through its partner team. An MSP on the MSP plan can create credentials itself, and the domain, report, DNS and audit log tools work with them. Without a partner agreement the partner tools answer "You don't have a partner account".

How StackJack authenticates to EasyDMARC

EasyDMARC gives you a Client ID and a Client Secret, created in the EasyDMARC Account Console under API Credentials. You paste both into StackJack.

There is no web address to enter. EasyDMARC runs one shared API for every customer, and StackJack already knows where it is.

Behind the scenes StackJack exchanges your Client ID and Secret for a short-lived access token whenever it needs one, and keeps it fresh on its own. EasyDMARC issues no refresh token, so there is nothing to renew on a schedule and nothing for you to rotate. If EasyDMARC ever rejects a token, StackJack gets a new one and tries once more before reporting a problem.

The Default Organization ID (optional)

Most EasyDMARC tools act on one organization: its domains, its reports, its audit log. One connection can reach every organization your API client can see, so each tool takes an organization ID. The Default Organization ID on the connection fills that in when a request does not name one, so you only have to type it once. Any request can still name a different organization.

A partner account can list every organization it owns with the organizations tool, so the box can stay empty. EasyDMARC does not say where an account without a partner agreement reads its organization ID. If you cannot find it, leave the box empty and give the ID in the request, or ask EasyDMARC support.

Steps

1. Check your plan includes API access, as described above.
2. Create an API client. Sign in to EasyDMARC, open the Account Console and go to API Credentials, then create a client for StackJack. EasyDMARC shows a Client ID and a Client Secret.
3. Copy both values straight away. Treat the secret as a password and keep it somewhere safe.
4. Find your organization ID, if you want a default (optional).
5. Enter the details in StackJack. Open Connectors, choose EasyDMARC, paste the Client ID and the Client Secret, and add the Default Organization ID if you have one. The form asks for the Client ID and Client Secret every time you save it.
6. Run a Test Connection. It proves the Client ID and Client Secret and that EasyDMARC accepts the token it issues. It does not prove access to any particular organization, so ask your AI to list the domains of one to confirm that.

What to know before your AI uses this connector

Partner tools need partner access

If the organizations, users, billing or partner profile tools answer "You don't have a partner account", or the request names an organization that does not belong to your partner account, the fix is the partner agreement or the organization ID, not a new key. The domain, report, DNS and audit log tools do not depend on it.

Some tools change what you are billed, or who has access

EasyDMARC's MSP plan is priced per managed domain, so adding domains can raise your bill. The partner subscription tools assign, renew, cancel and change plans, adding a payment method stores a payment token against a client organization, and the user tools invite people, create users directly with a role and remove access. Renaming an organization can also link it to a different partner account, which moves who manages and bills it. Replacing a whole domain record and taking a domain out of a group are labelled the same way. All of those are labelled as destructive so your AI assistant asks first. Cancelling a subscription, deleting an organization and removing a user's access cannot be undone from the API.

A few tools hand back a credential

Treat what these return as a password, and do not paste it into a ticket or a chat:

• the sign-in link tool returns a single-use link that signs whoever opens it in as that user
• creating a webhook and re-keying one return the signing secret used to verify deliveries, and reading or updating a webhook can return it too
• the payment method and billing information reads return a client's stored payment details
• the failure report and invoice download tools return an address that opens the file without further sign-in. A failure report link lives five minutes and carries the content of the original message

Some routes are documented but not switched on yet

EasyDMARC documents webhooks, DNS Intelligence, domain search and three single DNS lookups (TLS-RPT, MTA-STS and the MTA-STS policy CNAME), but its public gateway did not serve those routes when this connector was built. Four domain routes are in the same position because EasyDMARC's own specification marks them internal, under construction or not yet available: updating a whole domain record, verifying a domain's setup, adding several domains to a group and taking a domain out of a group. The tools are included. Until EasyDMARC turns those routes on, EasyDMARC answers that it cannot find the route. That is on EasyDMARC's side and says nothing about your credentials, and the neighbouring tools keep working, for example changing one field of a domain moves it to another group.

Failure reports carry message content

A failure (forensic) report describes an individual message that failed authentication, so it includes addresses and message metadata, and the detail tool can include the raw headers and body. EasyDMARC masks personal data by default. Grant these reads deliberately.

Plans and limits

Every read is available on the Free tier, including the ones EasyDMARC sends as a POST. Every change needs Pro. Business reaches the same tools as Pro and differs by monthly call quota.

See the generated EasyDMARC tool reference for the current inventory, plan assignment, input schemas, and destructive-action labels.

EasyDMARC allows 60 requests a minute per customer, plus daily limits it does not publish. StackJack paces itself below the minute limit and waits for the delay EasyDMARC asks for, so a wide sweep takes longer rather than failing. When you have several domains, use the batch DNS lookups: a batch counts once against the limit. Lists come back one page at a time, and StackJack always asks for a sensible number of rows on your behalf.

EasyDMARC sits behind Cloudflare. If Cloudflare ever challenges a request, StackJack reports it without counting it against your connection, so a passing challenge cannot switch off a working credential.

Several organizations and several accounts

One connection spans every organization the API client can reach, so an MSP with many client organizations needs one connection. If you hold more than one EasyDMARC account, add one connection per account from the connector's card, name each after the account, and your AI names it on each call. Omit the name and the call runs against your default connection. See Several connections of one connector.

Troubleshooting

"EasyDMARC did not accept the Client ID and Client Secret" - the API client was deleted, regenerated or disabled. Regenerating a client replaces both values. Open the Account Console, go to API Credentials, copy the pair again, paste both into the connection and run a Test Connection. Also check the plan still includes API access.

"EasyDMARC rejected the access token it had just issued (invalid_grant)" - StackJack already fetched a fresh token and tried once more, so the stored API client is the likely cause. Check it is still active in the Account Console, regenerate it if you are unsure, and paste the new pair in.

"organizationId is required" - the tool needs an organization and the request did not name one. Add a Default Organization ID to the connection, or give the ID in the request. A partner account can list its organizations first.

The partner tools say you do not have a partner account - that needs EasyDMARC's partner agreement, as described above. The other tools are unaffected.

"EasyDMARC's gateway does not serve this route yet" - the route is one of those EasyDMARC documents but has not switched on. Use the neighbouring tool, for example the domain list instead of domain search, or try again later.

Cloudflare challenged this request - nothing is wrong with the credentials and the connection was not counted as failing. It is usually a passing decision at the edge, so try again in a few minutes. If it keeps happening, open a support ticket.

Requests come back throttled - 60 requests a minute is shared across everything on your EasyDMARC customer account, including other integrations. Use the batch DNS lookups, ask for fewer rows per page, or space the work out. StackJack already waits for the delay EasyDMARC asks for.

A report tool returns nothing for a domain that has mail - the report tools are scoped by domain name and date range, and the domain must be added to the organization before its reports appear. Check the dates are ISO 8601, for example 2026-09-01T00:00:00.000Z.

EasyDMARC tools

easydmarc_ · 111 tools · Free 81 · Pro 30

DNS intelligence

DNS lookup

Domain groups

Domains

Webhooks

Access links

Billing information

Invoices

Organization users

Organizations

Partner profile

Payment methods

Subscriptions and plans

Users

Aggregate reports

Audit log

Failure reports