Red Sift's Quarterly Product Release: Fall 2026

Maintenance and triage can always be improved and refined, and removing that friction was a huge focus for us across the board this past quarter. With the introduction of new AI-enhanced classification reasoning in OnDMARC, monitoring and management of ACME-compatible certificates via our latest Certbot Integration, and streamlined phishing threat tracking in Brand Trust, Red Sift continues its future-forward approach to removing menial tasks and making your job easier than ever.

Every DMARC aggregate report drags in a pile of new sending sources, and somebody on your team has to sort out which ones are legitimate, which are forwarders, and which are actively trying to spoof you. Our old classification logic handled the easy cases well, but as cases became more complex, it became clear that further enhancements were needed to help users get the most out of the tool.

So, we decided to give the classification logic a major upgrade in thinking with our newest Radar Agent, AI Classifier. Source classification now runs on a model trained on real DMARC traffic, with full reasoning provided to you as evidence. Open any recommendation in the Source Statistics table or a source's Summary panel, and you'll see the evidence behind the call, the one factor that mattered most, and a confidence score.

Legitimate senders get flagged with sufficient confidence to be marked as assets right away, so you reach a reject policy sooner rather than babysitting the queue. You don't have to manually review every forwarder and threat recommendation anymore either, though you can always override one.

If you’re building detections or automations using DMARC data, you don’t want to write a client that relies on stitched-together GET requests and undocumented query parameters. V2 is a path-versioned REST API (/api/ondmarc/v2) with a full OpenAPI 3.1 spec, so you can import it straight into Postman or your codegen pipeline instead of hand-rolling one.

It covers domains; DMARC aggregate and per-record data via DMARC Analyst; TLS-RPT reporting; DMARC Guardian issues; email source classification; tags; and Dynamic Services configuration for SPF, DKIM, DMARC, and MTA-STS. Endpoints use standard REST semantics and return consistent, documented status codes instead of overloaded 200s. Source and reporting endpoints also accept multi-domain queries, so pulling data across an account doesn’t mean one call per domain.

If your security team runs on Microsoft Sentinel, email authentication used to be the only signal they had to dig up elsewhere. Now, the Red Sift OnDMARC Integration for Microsoft Sentinel streams OnDMARC forensic data, including SPF and DKIM results, and Red Sift platform audit logs straight into your Sentinel workspace in real time, so analysts can surface suspicious senders, domains, and login anomalies without leaving their existing workflow. It’s live now in the Microsoft Marketplace, available to existing OnDMARC customers with an active subscription and a Microsoft Sentinel workspace.

Read the full announcement for setup details, and what it means for our Microsoft partnership.

Certificate lifetimes are shrinking, and not gently. Max validity drops to 100 days in March 2027, then down to 47 days by March 2029. Plus, most environments aren’t neat or tidy. Some certs get renewed by hand, some run off a cron job nobody fully trusts anymore, and a few are quietly handled by a Certbot instance someone set up years ago that nobody’s touched since. Automation already exists in plenty of places. What’s usually missing is a single place to see it all.

Whether you’re automating your certificate renewals, starting fresh, or keeping an eye on what's already running. It's a lightweight client you install on your hosts, and it works in one of two modes:

• Managed mode hands Red Sift the renewal loop entirely, perfect if you're starting from scratch and want it handled.
• Observe mode attaches to a Certbot you already trust and reports on it without touching a single setting, perfect if you've got a setup you like and just want eyes on it.

Worried something will fall through the cracks? We’ve thought of that. With each Certbot integration, Red Sift independently re-scans the host from the outside, confirms the new certificate is actually being served, and reconciles that against the discovery, certificate transparency, and TLS posture data we already collect at internet scale. So when a renewal says it worked, you're not just trusting a log line; we’ve done the footwork to back it up.

The Certbot Integration is in beta now for Certificates Essentials and Enterprise customers. Want in? Contact your account team, and we'll get you set up.

Here's a familiar story: A customer forwards your support team a phishing email impersonating your brand. Someone reads it, means to look into it, gets pulled into three other things, and that intel sits in an inbox doing nothing. Meanwhile, the lookalike domain that sent it is still live.

Abusebox cuts out that middle step entirely. Forward a suspicious email to your dedicated Abusebox address, and Brand Trust will do the digging for you. It pulls every domain and URL out of the message, the sender, reply-to, subject line, body text, any links buried in the HTML, and checks each one against what you're already monitoring. Should anything new pop up in your Lookalikes list within the next processing run, Abusebox tags it so you can filter straight to what came in through reports.

A lookalike domain can keep sending phishing emails and catching visitors for days or weeks while a full takedown works its way through. Brand Trust doesn’t wait for that. When you request a takedown, we also automatically report the lookalike to Spamhaus, SURBL, Abusix and the UK’s National Cyber Security Centre (NCSC).

These virtual takedowns add those lookalike domains to blocklists that filter out suspicious mail, which many browsers check against, protecting your email infrastructure and potential website visitors.

You’ve got enough real problems to tackle in a single workday without adding manual babysitting to the list. The faster you can make a confident call, the faster you get back to the work that actually matters. Heading into winter, we’re still looking for ways to speed things up and automate the parts of the job you’d rather not do.

Got questions about anything here, or want help getting set up? Contact us. We’re happy to walk through it.