Lists the sources seen sending as this tenant's protected domains over the fixed 30-day window - the Analytics tab of the Domain Protection page - one row per (domain, source IP), with the window's counters alongside in Summary. The window is fixed; get-volume-series is the endpoint with a range.

The read covers every registered domain except paused ones: pause parks display and alerting, so the page excludes them. Pass includePaused: true to include them - ingestion never stopped, the history is there. domainName restricts the read to one registered domain; a paused domain asked for by name is still parked unless includePaused is true; without it the read set is empty and the response says so with Domains: [] and zero counters.

verifiedOnly defaults to the page's rule: ON when verified reporters have sent anything, UNLESS that would hide a failing source that only an unverified reporter saw. Anyone can mail fabricated reports at a published rua address, so the headline numbers (Summary.verifiedPassRatePercent, the verified volume lane) read the verified lane only - but a page whose purpose is surfacing "someone is sending as you and none of it authenticates" must not open with that row hidden. The value actually applied is echoed back as VerifiedOnly, so a caller who omitted it knows which view it got. Pass verifiedOnly: false to see every tier; each row states its own trustTier.

Rows are ordered failing-first, then by volume descending (OrderedBy says so), and limit truncates that list - default and cap 1000, the page's own render budget. Count is the number of rows after the tier filter and before limit; Returned is what Sources holds. summaryOnly: true returns the counters and an empty Sources, which is how an overview reads the stat cards without paying for rows.

isOwnInfrastructure on a row is an rDNS CLAIM, labelled as one by ownInfrastructureBasis: the source's PTR record reduces to one of the tenant's registered domains (all of them, paused included - a paused domain's mail server is still the customer's). A PTR is written by whoever controls the reverse zone and nothing here forward-confirms it, so treat a failing row that carries it as suspect rather than as a misconfigured server of your own.

The truncation flags are honest. Summary.isTruncatedRead and truncatedDomains say the window held more history than one read covers (the counters then describe what was read, not what exists); Summary.totalSourceCount counts every source read while Sources is capped at the render budget; Summary.readFailed says the read threw, in which case zero counters mean "we failed", not "no reports arrived". Nothing is written on this path.

Requires an Enterprise subscription (ErrorCode ENTERPRISE_REQUIRED; not satisfied by Professional, and get-entitlements.isEnterpriseEntitled does not imply it for partner-managed or staff-trial tenants). Admin-only read; no other paid entitlement required.