# get-mailbox-authentication

Free; envelope auth + ownership required (owner-only read). Sender authentication (DKIM signing and DMARC) for the domain of a mailbox you own, with the exact public DNS records still to publish. Works on `active`, `suspended`, and `expired` (grace-window) mailboxes. It is separate from mail routing (MX/SPF), which `get-mailbox-info` reports in `domain.dns`.

## Input

| Field | Required | Notes |
|---|---|---|
| `address` | yes | A mailbox you own through this provider. |

## Result artifact — `mailbox_authentication`

```jsonc
{
  "address": "scout@my-startup.example",
  "domain": { "name": "my-startup.example", "kind": "custom" },   // shared | custom
  "authentication": {
    "status": "dns_pending",         // not_configured | dns_pending | dns_conflict | lookup_unavailable | signing_pending | signing_configured | attention
    "dkim": "unverified",            // not_prepared | verified | unverified | conflict | lookup_unavailable
    "dmarc": "missing",              // present | inherited | missing | conflict | lookup_unavailable
    "selector": "daski20261105",     // omitted until a key is prepared
    "requiredRecords": [
      { "type": "TXT", "host": "daski20261105._domainkey", "value": "v=DKIM1; k=rsa; p=MIIB…" },
      { "type": "TXT", "host": "_dmarc", "value": "v=DMARC1; p=none" }
    ],
    "note": "…"
  }
}
```

## Reading the state

- `dns_pending` → publish each `requiredRecords` entry at the domain's DNS host (`host` is relative to the domain), then call again. For a Daski-managed domain, use `set-dns-record`. Signing starts automatically once the DKIM key resolves publicly; no customer access to the mail supplier is needed.
- `signing_configured` means the mail supplier signs outbound mail with this key. It is not a delivery or inbox-placement test.
- `not_configured` means no key has been prepared for the domain yet; Daski support can start it. `attention` means the supplier signs with a selector this provider did not set; it is left in place.
- `lookup_unavailable` means the resolver could not answer; it does not prove records are missing. Recheck later. `dns_conflict` requires correcting the conflicting record.
- An existing or inherited DMARC policy is preserved as found. Shared Daski domains list no records: Daski publishes them.
- If sender authentication cannot be read at all, the action fails as retryable (`authentication_unavailable`) instead of guessing a status.