Email & DNS
DMARC report reading: turn aggregate XML into useful sender evidence
DMARC aggregate reports summarize how receivers saw mail claiming to use your domain. They are useful for discovering legitimate senders, alignment failures, and obvious abuse patterns, but the source IP rows need context before you authorize or block anything.
Group by sending source and disposition
Look at source IP, message count, SPF result/alignment, DKIM result/alignment, and policy disposition. Large recurring sources deserve identification first because they affect the most mail.
A receiver may aggregate multiple days or systems differently, so report volume is not a perfect count of mail sent.
Map sources to known services
Compare IP/host ownership and DKIM selectors with mailbox providers, CRMs, newsletters, support platforms, invoicing, websites, and other approved senders. Maintain an internal sender inventory so approved services do not need to be rediscovered during every incident.
Unknown low-volume sources can be abuse, old infrastructure, forwarded mail, or a forgotten legitimate tool.
Distinguish authentication from alignment
A source can pass SPF for its own bounce domain but fail alignment with your From domain. DKIM can pass cryptographically but sign with a provider domain. DMARC cares about aligned pass, so read both dimensions.
Forwarded messages are especially useful when evaluating whether aligned DKIM survives.
Use trends before tightening policy
Fix recurring legitimate failures, watch report volume across a comparable period, and only then raise policy. Keep reports after enforcement so new vendors or regressions are detected.
- Prioritize high-volume sources.
- Map selectors/IPs to owners.
- Separate pass from alignment.
- Tighten policy only after legitimate senders are clean.