SpoofSentry Integrations

SpoofSentry integrates with PSA (Professional Services Automation) and RMM (Remote Monitoring and Management) tools used by MSPs and MSSPs. Supported platforms:

• ConnectWise Manage — Automatic ticket creation on domain posture changes, score drops, and new security findings. Uses Manage REST API v4.6. Supports ticket status polling, asset sync, and health checks.
• Autotask (Datto) — Same capabilities as ConnectWise. Uses Autotask REST API v1.0.
• HaloPSA — Ticket creation and status tracking. Uses OAuth2 client_credentials flow.

PSA integrations include circuit breaker protection (auto-disable on repeated failures) and credential audit logging. Plan requirement: Enterprise only.

SpoofSentry delivers security events to SIEM platforms for correlation with your broader security telemetry. Supported platforms:

• Splunk — Event delivery via HTTP Event Collector (HEC). Events formatted in CEF (Common Event Format) with severity mapping.
• Microsoft Sentinel — Direct event delivery with ECS (Elastic Common Schema) formatting.
• Elastic — Native event delivery with ECS formatting.
• Datadog — Event delivery with severity mapping and metadata tagging.

All SIEM integrations include test connection verification, health checks, and configurable event filtering. Plan requirement: Enforce and above.

SpoofSentry connects directly to DNS providers to preview, apply, verify, and rollback DNS changes for DMARC, SPF, DKIM, MTA-STS, and other records. Supported providers:

• Cloudflare — Full DNS management via Cloudflare API.
• AWS Route 53 — DNS record management via AWS SDK.
• Azure DNS — DNS management via Azure Resource Manager API.
• GoDaddy — DNS record management via GoDaddy API.
• Google Cloud DNS — DNS management via Google Cloud API.

All DNS integrations support: change preview (see what will change before applying), propagation verification (confirm changes have taken effect), and one-click rollback (revert to previous state). Plan requirement: All paid plans (Protect and above).

SpoofSentry sends real-time notifications to chat platforms when posture changes occur. Supported platforms:

• Slack — Formatted notifications with severity indicators, domain details, and action links.
• Microsoft Teams — Adaptive card notifications with the same detail level as Slack.
• Generic webhook — HTTP POST to any endpoint. Useful for custom automation, PagerDuty, or SOC tooling.

Notifications include event deduplication (no repeated alerts for the same issue) and configurable alert thresholds. Plan requirement: Enforce and above.

SpoofSentry provides guided setup recommendations specific to your email platform:

• Microsoft 365 — Auto-detects M365 usage from DMARC reports. Provides specific SPF include values, DKIM signing configuration steps, and DMARC alignment recommendations for Exchange Online.
• Google Workspace — Auto-detects Google Workspace from DMARC reports. Provides specific SPF include values, DKIM key generation instructions via Admin Console, and alignment guidance.

Email platform detection is automatic for all plans that receive DMARC aggregate reports.

SpoofSentry provides a REST API for programmatic access to domain scores, DMARC data, enforcement status, simulation results, and tenant management. API documentation is available at /api-docs. Webhook notifications deliver structured JSON payloads for real-time event processing. API and webhook access is available on Enforce and Enterprise plans.

• Monitor (free): No integrations. Manual-only workflows.
• Protect ($24/month): DNS provider integrations (Cloudflare, Route 53, Azure DNS, GoDaddy, Google Cloud DNS).
• Enforce ($65/month): Everything in Protect, plus SIEM integrations (Splunk, Sentinel, Elastic, Datadog), ChatOps (Slack, Teams, webhook), full API access, and webhook notifications.
• Enterprise (custom): Everything in Enforce, plus PSA/RMM integrations (ConnectWise, Autotask, HaloPSA), MSSP white-label portal, Enterprise SSO (OIDC/SAML), and dedicated onboarding.

See pricing for full plan comparison.