Understanding your dashboard
Once your first reports arrive, the dashboard is where you'll spend your time. This is a tour of every screen and — most importantly — a plain-English key to the verdict tags. Everything described here is live in the product; if you don't have data yet, you can explore the domain detail view with sample data in the demo — no account needed.
The all-domains overview
The dashboard opens on the overview: every domain in your workspace on one screen. Across the top:
- Four KPI cards — Domains, Total messages, Compliance and Failing — aggregated across your whole workspace for the selected window.
- A daily volume chart stacking compliant (aqua) against non-compliant (coral) messages. Hover any bar for the exact numbers: compliant, non-compliant, total and compliance percentage for that period. On longer windows the bars bucket up automatically — daily for 7 or 30 days, weekly for 90 days, monthly for 12 months.
Below sits a card per domain: its Verified or Pending badge, a compliance ring showing the percentage of mail passing DMARC, message count, threat count and when the last report arrived. Cards with active threats are flagged visually. Click any card to open that domain's detail view.
The reporting window selector in the top bar — Last 7 days, Last 30 days, Last 90 days or Last 12 months — drives both this screen and the detail view. 90-day and 12-month windows are available on Starter and above; Free includes 30 days — see pricing.
The domain detail view
The detail view answers one question: is this domain's mail authenticating, and if not, what's failing? Top to bottom:
- Four KPI cards — Total messages, Aligned (DMARC pass), Active sending sources, and Threats blocked / failing.
- Compliant vs non-compliant volume — a trend chart of aligned (aqua) against failing (coral) volume over the selected window. Move your cursor along it for a crosshair and tooltip with per-day counts. The domain dashboard charts deep dive explains every chart element, bucketing behaviour and Y-axis scaling.
- What changed this period — a summary card that turns the period's numbers into sentences: the compliance rate, message and source counts, whether any sources failed both SPF and DKIM, and a recommended next step. Its pill grades the period Low, Medium or High severity.
From the top bar you can also switch domains, add another domain, open the domain's settings (DNS record, verify, remove) and export the current view.
Sending sources, grouped by provider
The Sending sources table is the heart of the dashboard. Instead of a wall of anonymous IP addresses, traffic is grouped by the provider that actually sent it — Microsoft 365, Postmark and so on, with anything unrecognised under Unknown. Each group row shows the provider, how many distinct sources it spans, total messages and a single rolled-up verdict pill. Click a group to expand its individual sources: the From domain, sending IP, country, message count, and per-source SPF, DKIM and DMARC verdicts.
This grouping is what makes action obvious. One glance tells you "Microsoft 365 passes, the CRM fails" — which is a to-do list, not a data dump. Sending sources and ESP grouping goes deeper on how providers are detected and what to do when sources appear under Unknown.
What each verdict means
The table uses a small set of tags, and they're worth learning precisely.
Group pills (one per provider, summarising all its sources):
| Tag | Meaning |
|---|---|
pass | Every source in the group passes DMARC — at least one of SPF or DKIM is aligned. |
fail · p=none | No source in the group aligns. Under a monitoring (p=none) policy this mail is still delivered — the tag is a reminder that nothing is being blocked yet. |
mixed | Some of the group's sources pass and some fail — typically a provider that is half-configured. Expand it to see which. |
would reject | At least one source in the group is a threat — mail failing both SPF and DKIM, the signature of spoofing. "Would reject" means exactly that: under p=reject this mail would be refused. |
Per-source columns, once a group is expanded:
- The SPF and DKIM columns each show
✓ alignedor✕ fail— whether that mechanism passed and matched your From domain. Alignment is the part people miss; DMARC alignment explained covers why a "passing" SPF check can still fail here. - The DMARC column gives the source's overall verdict:
pass,fail · p=none, orwould rejectfor threat sources.
LED colours carry the same story at a glance: aqua for pass, amber for mixed or failing groups, red for threats — the same red used on threat rows and threat countries.
Countries, the policy advisor and export
Three more cards round out the view:
- Top countries ranks sending countries by message volume, with flags and proportional bars — a country's bar turns red if threat traffic originated there. "Your" mail suddenly coming from a country you've never operated in is one of the fastest spoofing tells.
- Policy advisor shows your current published policy and the enforcement ramp —
p=nonetop=quarantine · pct=25top=reject— with "you are here" marked. The Recheck DNS button reads your live_dmarcrecord straight from DNS, so the advisor reflects what you've published right now rather than what past reports observed. - Export (top bar) downloads the current view as CSV — a per-domain summary from the overview, or the per-source table from a detail view.
The dashboard aggregates thousands of XML reports into these views; if you want to understand the raw material underneath, read How to read a DMARC report.