Where your mail comes from
One of the fastest spoofing tells doesn't require reading a single authentication result: "your" mail suddenly originating from a country your business has never operated in. The Top countries card on each domain's dashboard exists for exactly that glance.
The Top countries card
The card ranks every sending country in the reporting window by message volume. Each row shows the country's flag and name, its message count, and a proportional bar so the distribution is readable without arithmetic. Two details carry the signal:
- A country's bar turns red when threat traffic — mail failing both SPF and DKIM — originated there. Legitimate countries stay in the neutral accent colour, so one red bar in the list is impossible to miss.
- Sources we can't place still appear, listed without a country, rather than being silently dropped. Volume never disappears from the picture just because an IP didn't resolve.
The card lives in the domain detail view alongside the sending-sources table, and both are scoped to the same reporting window — when the countries card raises a question, the grouped sources table is where you answer it.
How IP-to-country lookup works
Every source IP in your reports is mapped to a country at ingest time, using a local copy of the MaxMind GeoLite2 Country database loaded into our own database as an IP-range table. Three properties of that design matter to you:
- It's offline. The lookup happens inside our infrastructure — no per-message calls to any third-party service, and none of your report data leaves us to be geolocated.
- It's refreshed weekly. MaxMind rebuilds GeoLite2 regularly, and we reload our copy on a weekly schedule, so newly reassigned IP ranges don't stay wrong for long.
- It's applied at ingest. A source's country is stored with the report row, so historical views stay fast and consistent.
This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com
What geolocation can and cannot tell you
IP geolocation is an approximation, and it's worth being precise about what kind. It reflects where an IP range is registered and routed — not where a person sat when they clicked send. Two honest caveats:
- Cloud and ESP infrastructure dominates. If you're a European business using an American email provider, a large United States bar is your own legitimate mail leaving your provider's datacentres. Check the provider grouping before reacting to the map.
- Accuracy is country-level at best. GeoLite2 is the free tier of MaxMind's data; it's dependable for "which country", not for anything finer — which is all this card claims to show.
Treat the card as a signal, not proof. The proof is in the authentication results: a red country bar means some traffic from there failed both SPF and DKIM, and the corresponding would reject rows in the sources table carry the actual IPs and From domains.
Using it in practice
Learn your domain's normal shape first — most domains settle into a stable handful of countries that mirrors their providers and customer base. From then on the card is a diff against normal:
- A red bar in a familiar country usually means spoofing that impersonates you from mainstream infrastructure. The volume and IPs are in the sources table.
- A new country with a red bar is the classic pattern — commodity spoofing runs from wherever is cheap. Under
p=rejectthis mail gets refused; underp=nonethe card is your early warning. - A new country with a normal bar is often internal news: a new tool, a new office, a contractor. Expand the matching source group and identify it before it surprises you in an audit.
The countries card is one part of the wider triage flow — see Understanding your dashboard for how it fits alongside the KPIs, trend chart and policy advisor.