Investigating Domains and Sending Sources
Investigating the DMARC Status of Domains
The Overview page allows you to drill down to domains and analyze the sources sending emails on the organization's behalf.
To analyze the DMARC status of a domain, click the domain from the table. The system shows these details describing the different sending sources:
Column |
Description |
|---|---|
New |
Indicates if the source has recently started sending emails on behalf of the domain.
To see the first instance of the domain sending emails on behalf of the domain, hover over the source name / IP address. |
Sent via Source |
The service provider used to send the email. To investigate the IP addresses from which the sending source sent emails on behalf of the domain, see Investigating a Specific Sending Source. |
Reported Emails |
The number of reported emails sent from this source on behalf of the domain. |
Reported Failed Emails |
The number of emails sent from this source, which failed DMARC authentication. |
DMARC % Failures |
The percentage of emails that failed DMARC out of the total number of reported emails sent from the source. |
SPF % Failures |
The percentage of emails that failed SPF out of the total number of reported emails sent from the source. |
DKIM % Failures |
The percentage of emails that failed DKIM out of the total number of reported emails sent from the source. |
SPF Not Aligned |
The percentage of the emails whose SPF is not aligned out of the total number of reported emails sent from the source. |
DKIM Not Aligned |
The percentage of the emails whose DKIM is not aligned out of the total number of reported emails sent from the source. |
Number of Reporters |
The number of unique servers that reported emails being sent from this source. |
Distinct IP Addresses |
The number of unique IP addresses used by the source to send emails. |
Tags |
Tags assigned to the source. See Annotating / Tagging Domains and Sending Sources. |
Investigating a Specific Sending Source
You can drill down to a specific sending source for a particular domain to investigate the IP addresses from which the sending source sent emails on behalf of the domain.
To do that, after you drill down to the specific domain, click on one of the source names in the Sent via Source column. The system shows these details:
| Column | Description |
|---|---|
| IP Address |
IP address of the sending source. For more information about the IP address, see Investigating a Single Sending IP Address. |
| Location | The geo-location of the IP address. |
| Reported Emails | The number of reported emails sent from this IP address by the source. |
| Reported Failed Emails | The number of emails sent from this IP address, which failed DMARC authentication. |
| DMARC % Failures | The percentage of emails that failed DMARC out of the total number of emails sent from the IP address. |
| SPF % Failures | The percentage of emails that failed SPF out of the total number of emails sent from the IP address. |
| DKIM % Failed | The percentage of emails that failed DKIM out of the total number of reported emails sent from the IP address. |
| Number of Reporters | The number of unique organizations that reported emails being sent from this IP address. |
| Number of Envelope | The number of unique envelops to values in emails sent from this IP address. |
Investigating a Single Sending IP Address
To view more information about the IP address of a specific sending source, click the IP address in the table. The system shows these details for the IP address:
| Column | Description |
|---|---|
| IP | IP address |
| Host name | Host name |
| Location | The geo-location of the IP address. |
| ASN | Autonomous System Number (ASN) of the IP address. |