Sources
The sources section under DMARC Reports gives you aggregate data from reports highlighting the source of emails from your domain.
DMARC provides visibility into external sources, including ESPs and ISPs, allowing for enhanced security when it comes to email deliverability.
A first sight gives you an overview of failure rate, compliant messages, total email volume, and number of reports received for the domain and time range selected in the filters section. Next some charts show you who is sending on your behalf, domains from where the email originated, and volume by day split by compliant and non-compliant messages.
Then two tables with the top 5 domains by failure and compliance. At least, a list of all the source domains with:
- IP Count: number of different IPs in the same source domain
- FROM: Domains: number of variations of your domain in the "header from" field of messages
- Volume: number of messages originated by that domain
- Compliance: compliance rate
- SPF: SPF alignment rate
- DKIM: DKIM alignment rate
- Forwarded: how many emails are forward
By clicking on each of these rows you can get the detail of a specific source domain.
Source Domain
The source domain section gives you information about all sources referable to that domain.
The map shows the volume of emails originating from all servers referable to the selected domains from each country. The detail list shows compliance data for each server and header from the domain:
- Source PTR/Server: the actual server IP and address from where the messages came from
- Header FROM: the domain in the "header from" field of messages
- Volume: number of messages originated by that source
- Compliance: compliance rate
- SPF: SPF alignment rate
- DKIM: DKIM alignment rate
- Forwarded: how many emails are forward
By clicking on each of these rows you can get the detail of a specific source.
Source Domain Organization Lookup
The Source Domain Organization Lookup feature provides additional information for the source domains and IP addresses received from DMARC reports.
By clicking the magnifying glass icon next to a source domain or IP address, the platform performs an OSINT (Open Source Intelligence) lookup to identify the organization associated to that infrastructure.
This functionality helps administrators quickly understand whether the sender infrastructure is legitimate, trusted, or potentially suspicious without needing external investigation tools.
The intelligence is gathered automatically through OSINT sources and displayed directly inside the LetsDMARC interface to simplify analysis, all thanks to the LibraCyber AI.
Source Detail
Each section gives you a narrow view of data, in this case, more detailed information about the geolocation of the source.
The details section shows all receivers (reporters) who notified messages from the same source and attributes:
- Report: date of the report and name of the reporter
- Volume: number of messages
- SPF Result: the result of SPF-related DMARC check (SPF alignment)
- DKIM Result: the result of DKIM-related DMARC check (DKIM alignment)
- Compliance: DMARC compliance
By selecting one of the results, you get the detail of that situation
Result detail
The last section of the DMARC report analysis gives you the specific situation explained in detail.
First a quick overview of the main attributes of the situation:
- SPF Result: the result of SPF-related DMARC check (SPF alignment)
- DKIM Result: the result of DKIM-related DMARC check (DKIM alignment)
- Forward: if the message is identified as forwarded
- Compliance: the DMARC compliance result
- Disposition: the final decision made by the receiver, eventually honoring your published policy:
- Pass: Message accepted
- Quarantine: Message marked as quarantine
- Reject: Message rejected
What happened
In this section the final situation is explained in plain words: identifying the situation, explaining the DMARC check result, and, if this is the case, giving the user a possible solution to fix issues.
Then all the information is displayed in more detail:
- Disposition: with eventually a reason if your published policy has not been honored and has been overridden
- DMARC Policy Published: the published policy at the time of the event
- Reporter (receiver): Information about the report where this event has been reported
- Sender: information about the send, origin server, and number of messages of the same kind
- SPF Domain: domain used in the HELO command at the SMTP connection stage
- Header FROM: domain shown to the user when a message is displayed in an email client
- SPF Result: SPF checks the result and its alignment with the header FROM the domain
- Envelope From/To: if supplied by the reporter (receiver) the additional header fields about the envelope of the message
- DKIM Signature: list of all signatures found in the message
- DKIM domain: domain of the signature
- DKIM selector: selector (identifier) of the signature
- DKIM Valid: the result of DKIM checks of the signature
- DKIM Alignment: if the domain is aligned with header FROM domain
The "show raw report" button gives you the ability to see the actual XML report received where this particular situation has been reported among others.