Lists the domains this tenant has registered for Domain Protection - owned-domain DMARC, SPF, DKIM, MTA-STS, TLS-RPT and BIMI monitoring - as registry rows, newest first. Distinct from /domain/list-domains, which lists the SENDING domains verified for phishing simulations: these are the domains the tenant owns and asked us to watch, and the two registries are different tables.

Each row carries its lifecycle state - pending_dns (registered; our reporting address not yet seen in the live DMARC record), verified (the record carries the address, so ownership is proven), monitoring (aggregate reports are arriving) or paused (display and alerting parked; ingestion continues) - plus the reporting address receivers send reports to, the DMARC record as last observed, the policy tags reporters actually applied, and the starting records to publish. Removed domains are never returned. No analytics here (get-protected-domain and list-sending-sources carry those), so this stays cheap enough to poll after add-protected-domain.

Limits.domains is the registry cap (50). Paused domains count towards it; removed ones do not. Nothing is written on this path.

Requires an Enterprise subscription (ErrorCode ENTERPRISE_REQUIRED; not satisfied by Professional, and get-entitlements.isEnterpriseEntitled does not imply it for partner-managed or staff-trial tenants). Admin-only read; no other paid entitlement required.