What an aggregate report can tell you.

Start with coverage

The headline pass rate is useful, but it is not the whole story. A high percentage can still hide a low-volume system that will break when enforcement is enabled.

• Reporters that supplied data during the selected period.
• Total messages represented by all accepted records.
• The published policy receivers said they evaluated.

Separate known and unknown sources

A source is evidence, not automatically a threat. Microsoft 365, Google Workspace and transactional platforms may all appear legitimately. Unrecognised IP space needs investigation before it is classified.

Microsoft 365     126,402   aligned
Google Workspace    41,088   aligned
Unknown source       2,491   review

Understand why a message passed

DMARC passes when at least one supported identifier is both authenticated and aligned with the visible From domain. A raw SPF pass or DKIM pass is not enough if it belongs to an unrelated domain.

• SPF alignment compares the authenticated Mail From domain with the visible From domain.
• DKIM alignment compares a passing signature's d= domain with the visible From domain.
• Relaxed alignment allows the same organisational domain; strict alignment requires an exact match.

Turn exceptions into a rollout plan

Review legitimate failures, correct the sender configuration, then watch subsequent reporting periods. Enforcement should follow evidence rather than a timetable alone.