Red Sift’s fall drop: AI DMARC triage, Sentinel feed, and a Certbot double‑check

Red Sift just rolled out an AI-powered way to tame messy DMARC reports, a proper v2 API, a Microsoft Sentinel feed for forensic data, and a Certbot check that proves your renewals really went live. The pitch: less babysitting, faster enforcement, and fewer gaps when certificates churn.

The release also leans into takedown logistics. Their Brand Trust tools now turn forwarded phishing into structured intel and, on demand, auto-report lookalike domains to major blocklists while a full domain takedown crawls along.

What happened

Red Sift introduced an AI Classifier inside OnDMARC’s Source Statistics and source Summary views that’s trained on real DMARC traffic and exposes its reasoning, the single most important factor, and a confidence score, according to the company’s fall release post. With sufficient confidence, legitimate senders can be auto-marked as assets to speed a DMARC p=reject policy.

The update reduces manual review for forwarders and threat flags by default, while still letting admins override recommendations at any time, per Red Sift’s description. That aims squarely at the pile-up that happens as aggregate DMARC reports keep surfacing new sources.

On the integration front, Red Sift published a path-versioned v2 REST API at /api/ondmarc/v2 with a full OpenAPI 3.1 specification so teams can import it into Postman or code generation directly, not hand-roll clients. Endpoints follow standard REST semantics with documented status codes instead of overloaded 200 responses.

The new API covers domains; DMARC aggregate and per-record data via DMARC Analyst; TLS-RPT reporting; DMARC Guardian issues; email source classification; tags; and Dynamic Services configuration for SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), DMARC (Domain-based Message Authentication, Reporting, and Conformance), and MTA-STS (SMTP Strict Transport Security). Source and reporting endpoints support multi-domain queries to pull account-wide data without looping per domain.

Security operations get a direct link: the OnDMARC Integration for Microsoft Sentinel streams OnDMARC forensic data—including SPF and DKIM results—and Red Sift platform audit logs into an organization’s Sentinel workspace in real time. Red Sift says it’s live in the Microsoft Marketplace and available to existing OnDMARC customers with an active subscription and a Microsoft Sentinel workspace.

Red Sift also announced a Certbot Integration to monitor and manage ACME-compatible certificates from a single place. It runs in two modes: “Managed” delegates the renewal loop to Red Sift, while “Observe” attaches to an existing, trusted Certbot and reports without changing settings. The client is in beta for Certificates Essentials and Enterprise customers, with access via account teams.

To catch silent failures, each Certbot integration triggers an independent external scan to confirm the new certificate is actually being served, then reconciles findings against discovery, certificate transparency data, and TLS posture telemetry that Red Sift collects at internet scale. That addresses cron jobs that say “renewed” while the old cert is still on the wire.

Inside Brand Trust, Abusebox lets you forward phishing emails to a dedicated address so the system extracts domains, URLs, sender and reply-to fields, subject, body text, and any HTML links. It checks those against monitored assets and tags any new items that appear in your Lookalikes list on the next processing run.

When you click “takedown” on a lookalike, Red Sift says Brand Trust also files what it calls virtual takedowns: automatic reports to Spamhaus, SURBL, Abusix, and the UK’s National Cyber Security Centre (NCSC) to get suspicious domains blocklisted while a registrar or host-level takedown proceeds. That can shield recipients and web visitors during the gap.

The background

Red Sift frames the changes against shortening certificate lifetimes: it cites a drop in maximum TLS validity to 100 days in March 2027, then to 47 days by March 2029. That pace shrinks the window for renewal errors to go unnoticed, pushing teams toward automation and external verification.

DMARC rollouts keep colliding with volume and variety. Aggregate reports pull in unfamiliar SaaS senders, forwarders, and outright spoof attempts, stretching manual triage. The AI Classifier is intended to reduce bottlenecks so organizations can move from monitoring to p=reject without parking in review backlogs.

API maturity matters because many senders now automate policy checks and inventory. A versioned REST design with an OpenAPI 3.1 spec lowers friction for internal tooling, compared with ad hoc GET requests and undocumented parameters that break quietly. Multi-domain queries also reflect the way portfolios are actually managed.

Security teams increasingly want email auth signals alongside endpoint and identity telemetry. By streaming SPF and DKIM outcomes and audit logs into Sentinel, OnDMARC gives defenders one console for triage—mirroring the consolidation trend we covered when Proofpoint connected detections into Microsoft Defender in one-console workflows.

The takedown pipeline intersects with blocklists that affect deliverability and browsing safety. Spamhaus and SURBL entries can steer suspicious mail away from inboxes, which we’ve seen spike in volume alongside domain registrations in Spamhaus’s recent figures. Making those reports automatic at takedown time closes a loop that often relied on separate teams.

If you’re tracking the longer arc of authentication pressures, these updates line up with vendors and regulators turning DMARC from “nice to have” into table stakes. We’ve reported on practical rollouts in our four-week plan to harden delivery under stricter rules in DMARC just got real, and this release offers more knobs to get there without weeks of spreadsheet wrangling. You can find more on this topic under our authentication hub.

What people are saying

Red Sift says the AI Classifier’s calls come with “full reasoning,” highlighting the one factor that mattered most and a confidence score for each recommendation, so admins can see why a source was tagged. The company positions this as evidence-first triage, not a black box.

On the Sentinel side, Red Sift emphasizes that “analysts can surface suspicious senders, domains, and login anomalies without leaving their existing workflow,” aiming for less console switching and faster investigations, per its announcement. Availability via the Microsoft Marketplace is meant to simplify deployment for existing customers.

For certificates, Red Sift argues that the integration isn’t just automation—it also verifies externally that renewals took effect by rescanning hosts and cross-checking with certificate transparency and TLS posture data. The company says, “you’re not just trusting a log line,” pointing to reliability when cron jobs or hand renewals drift.

The Brand Trust team says Abusebox “cuts out that middle step,” parsing reports as soon as they hit the inbox so new lookalikes get tagged during the next processing run. The auto-reports to Spamhaus, SURBL, Abusix, and the UK NCSC are explicitly tied to the user’s takedown request, clarifying who pulls which lever.

What happens next

For organizations chasing p=reject, the practical next move is to test the AI Classifier with conservative thresholds, monitor confidence distributions, and decide where auto-asseting is allowed. Overrides should be logged so teams can tune rules as their sender mix shifts.

Security operations can install the Sentinel integration and build playbooks that pivot off SPF/DKIM failures, unusual source spikes, or new domains in forensic data. Audit log streaming enables change tracking inside the Red Sift platform without a separate export step.

Certificate owners on 90‑day cycles can pilot the Certbot Integration in “observe” mode to inventory renewals reliably, then move priority domains to “managed” renewals ahead of the March 2027 validity change. External verification helps prove fixes when outages blur internal logs.

Brand and abuse teams can route customer-forwarded phish into Abusebox to standardize intake, then use the takedown workflow when they want virtual takedowns to hit Spamhaus, SURBL, Abusix, and the UK NCSC immediately. Tracking tags back to source reports tightens feedback loops.

If you’re weighing broader authentication work, pair these features with steady DMARC enforcement steps and ongoing TLS hygiene we’ve laid out in our four‑week plan and the TLS lessons from the eMudhra certificate incident. The tooling here is built to remove drudgery; the policy decisions still rest with you.