Reports

Sending Sources: who is sending email as your domain

This is the page most people come back to. It lists everyone the world has seen sending mail with your domain in the From address, and tells you whether each one is you, a forwarder, a vendor you forgot about, or an attacker.

Where to find it

Reports → Sending Sources

Two tables

Sources are grouped by provider and split in two: those that pass DMARC, and forwarders or indirect senders that don't. Each row shows the provider's logo and name, a trust badge and how much mail it sent.

What the badges mean

• Approved. SPF and/or DKIM passed. This is a legitimate sender doing the right thing.
• Forwarder. Passed via known forwarding infrastructure such as Gmail, Outlook or a mailing list. Normal.
• Unapproved. Failing, but DMARCS recognises it as a real vendor (a CRM, a newsletter tool). Someone in your company is probably using it without it being set up properly. DMARCS calls this a Shadow IT Alert.
• Spoofing. Failing and completely unrecognised. Likely someone pretending to be you.

Digging into a source

• Click a source name to see every individual record with its SPF and DKIM result.
• The PTR & Geo and Reputation columns load when you click Check, not automatically, so the page stays quick. Reputation tells you whether the IP is on a blacklist.
• Each row has three quick actions: an AI explanation of what this source is, a request for an expert review by the DMARCS team, and, when DMARCS recognises the vendor, a one-click remediation guide with the exact DNS change to make.

What to do with what you find

• Amber rows: find out who in your company uses the service, then add it to SPF and switch on DKIM at the vendor. The remediation guide gives the exact records.
• Red rows: nothing to fix on your side. Moving your policy to quarantine or reject is what stops them. The Enforcement Guide tells you when you're ready.