Reports

Dashboard (Overview)

What it is: the landing page for the domain (or "All Domains") currently selected in the header, scoped to a date range you pick: 7 days, 30 days, 3 months, all time, or a custom range.

What you'll see:

• Domain Security: five rows, one each for SPF, DKIM, DMARC, BIMI, and TLS (MTA-STS). A green checkmark means that record is present and healthy; a red X means it's missing; a gray "Unknown" badge means DMARCS couldn't determine the state yet (never shown as a false pass). Use this as a literal to-do list: anything not green is a gap.
• Total Emails and Authentication Sources charts: a bar chart splitting volume into Authorized vs. Failed, and a donut chart of the same split with your overall pass percentage in the center, labeled "Secure."
• Enforcement Ready: your compliance rate as a percentage, the share of mail that passed DMARC (SPF or DKIM aligned).
• Policy Status: your live DMARC policy (p=) read straight from DNS, with a 3-stage strip (none → quarantine → reject) showing where you are today.
• Estimated Savings: an indicative dollar figure (failed/blocked messages × a fixed per-message cost estimate) for reporting to leadership, a directional number for stakeholder conversations, not an accounting figure.
• Recommended Actions: up to three prioritized next steps, each with a button that jumps straight to the tool that fixes it (e.g. "Upgrade" to the Enforcement Guide, "Investigate" to Sending Sources).
• Traffic Flow / Geographic View tabs: Traffic Flow breaks down pass/fail separately for SPF, DKIM, and DMARC alignment, then visualizes where mail actually ends up (delivered, quarantined, or rejected) based on each message's real receiver disposition. Geographic View plots the same traffic on a world map, sized and colored by volume and fail rate.

Upload Custom Report

What it is: a way to load a DMARC aggregate or SMTP TLS report file you received outside DMARCS's own mailbox pipeline (forwarded from another team, exported from another tool, etc.) directly into your account, instead of waiting for the normal automated pipeline. Available to Organization Admin and Organization User roles.

How to use it:

1. Go to the upload area on your Dashboard and choose DMARC Aggregate Report or TLS Report.
2. Drag in, or click to choose, your file: .xml or .xml.gz for an aggregate report; .json or .json.gz for a TLS report.
3. DMARCS parses it and takes you straight to that domain's report the moment it succeeds.

Sending Sources

What it is: every IP or service DMARCS has seen sending mail as your domain, grouped by provider and split into two tables: sources that pass DMARC authentication, and forwarders/indirect senders that don't.

What you'll see per source: a provider favicon and name, a trust badge, and a volume count. Trust badges range from green ("Approved", SPF and/or DKIM passed) through blue ("Forwarder", passed via known forwarding infrastructure like Gmail, Outlook, or a mailing list) to amber ("Unapproved", failing but recognized as a known vendor, DMARCS calls this a "Shadow IT Alert") to red ("Spoofing", failing and completely unrecognized). Click a source name for a detail view of every individual record's SPF and DKIM result.

PTR & Geo and Reputation columns load on demand (click "Check") rather than automatically, so the page stays fast; reputation flags a source as blacklisted or clean.

Why use it: this is where you find unknown senders (possible spoofing) or confirm a legitimate service is actually passing. Each row has quick actions: an AI explanation of that source, a request for an expert review, and, when DMARCS recognizes the vendor, a one-click remediation guide with the exact DNS fix.

Reports Hub

What it is: three tabs, Report Inventory, Custom Builder, and Automation, for generating and scheduling polished, stakeholder-ready reports.

• Report Inventory: your generated reports, grouped by month, with a type badge (Semi-Monthly, Monthly, Quarterly, Yearly, Custom, Security) and a PDF download button per report. You can also request an on-demand report for any date range here; generation runs in the background and DMARCS emails you when it's ready.
• Custom Builder: filter raw records by date, source IP, provider, SPF result, and DKIM result, preview the matching rows, then export to CSV.
• Automation: set up recurring report delivery by email, pick a domain (or All Domains) and a comma-separated recipient list, and DMARCS sends the report on schedule automatically.

Why use it: pick the tab that matches the audience: Inventory for pre-built Executive/Detailed/Compliance PDFs, Custom Builder for an ad-hoc data pull, Automation for a standing report someone should get every period without asking.

Forensic Analysis

What it is: message-level detail for individual authentication failures, built from the DMARC forensic/failure (RUF) reports mail servers submit. Not every sender supports RUF, so this table only has entries for the ones that do.

What you'll see: a table of failures with the time, subject, source IP, a trust-level badge (same coloring as Sending Sources), separate SPF/DKIM pass-fail badges, and the failure type. Click a row to open the detail view, which reconstructs the authentication header for that specific message where the reporter provided enough raw data to do so.

Why use it: to distinguish a real spoofing/misconfiguration problem from ordinary mail forwarding, at the level of one specific message rather than an aggregated count.

Data Explorer (Traffic)

What it is: a free-form query view over your raw DMARC data, for the ad-hoc questions the pre-built reports don't answer.

What you'll see: a filterable table (All / Passing / Failing / Forwards, plus a search box for IP, hostname, or domain) with columns for Source IP, Hostname, From Domain, Country, an SPF/DKIM pass-fail mini-badge pair, and Volume. Click any source IP to open its full detail view.

Why use it: when you need to slice the data yourself, e.g. "show me everything failing from this country", rather than reading a fixed report layout.

TLS Reports

What it is: SMTP TLS reporting per RFC 8460: whether other mail servers could establish encrypted TLS connections to you. Defaults to a 30-day view; pairs with Hosted MTA-STS under Setup & Records.

What you'll see:

• An Encryption Rate figure at the top: successful TLS connections as a percentage of all attempts.
• A live check of your MTA-STS policy, whether the mta-sts host actually resolves, and whether TLS reporting itself is configured, each shown pass/fail with the exact fix if something's missing.
• Smart Recommendations: automatic, severity-colored advice (e.g. "High TLS Failure Rate: 12.3%" flagged critical above 20%, or a clean "Excellent TLS Posture" card if nothing needs attention).
• A Policy Details table per policy domain, a stacked chart of encrypted vs. failed traffic per mail server, and a Failure Reasons breakdown you can drill into by sender IP.
• A Reporters panel listing every organization that has sent you a TLS report, with its own success/fail ratio, click one to drill into exactly which reports it sent you.

Why use it: TLS reports don't tell you about DMARC alignment. They tell you whether mail heading to you is actually encrypted in transit, which is the piece MTA-STS enforces.