Understanding your dashboard
Once your first reports arrive, the dashboard is where you'll spend your time. This is a tour of every screen and — most importantly — a plain-English key to the verdict tags. Everything described here is live in the product; if you don't have data yet, you can explore the domain detail view with sample data in the demo — no account needed.
The all-domains overview
The overview puts every domain you can see on one screen — the domains of the workspace picked in the menu, or of all of them. The dashboard usually opens on it; if you were last looking at one domain, or you have only one, it may open on that domain instead. Across the top:
- Four KPI cards — Domains, Total messages, Compliance and Failing — aggregated across the domains on screen for the selected window.
- A daily volume chart stacking compliant (aqua) against non-compliant (coral) messages. Hover any bar for the exact numbers: compliant, non-compliant, total and compliance percentage for that period. On longer windows the bars bucket up automatically — daily for 7 or 30 days, weekly for 90 days, monthly for 12 months.
Below sits a card per domain: its Verified or Pending badge, a compliance ring showing the percentage of mail passing DMARC, message count, threat count and when the last report arrived. Cards with active threats are flagged visually. Click any card to open that domain's detail view.
The reporting window selector in the top bar — Last 7 days, Last 30 days, Last 90 days or Last 12 months — drives both this screen and the detail view. 90-day and 12-month windows are available on Starter and above; Free includes 30 days — see pricing.
The domain detail view
The detail view answers one question: is this domain's mail authenticating, and if not, what's failing? Top to bottom:
- Four KPI cards — Total messages, Aligned (DMARC pass), Active sending sources, and Threats blocked / failing.
- Compliant vs non-compliant volume — a trend chart of aligned (aqua) against failing (coral) volume over the selected window. Move your cursor along it for a crosshair and tooltip with per-day counts. The domain dashboard charts deep dive explains every chart element, bucketing behaviour and Y-axis scaling.
- What changed this period — a summary card that turns the period's numbers into sentences: the compliance rate, message and source counts, whether any sources failed both SPF and DKIM, and a recommended next step. Its pill grades the period Low, Medium or High severity.
From the top bar you can also switch domains, add another domain, open the domain's settings (DNS record, verify, remove) and export the current view.
Sending sources, by outcome and provider
The Sending sources table is the heart of the dashboard. Instead of a wall of anonymous IP addresses, it answers two questions in order: did this mail prove it came from you? and who sent it? Traffic is split into three sections — Verified, Carried by DKIM alone and Not verified — and inside each, grouped by the provider that sent it (Microsoft 365, Postmark and so on, with anything unrecognised under Unknown). Each section's header counts its messages and sources and breaks them down by reason, so the first screen already tells you whether there is anything to fix.
Expand a provider to see its individual sources: the From domain with the reason and last seen date, the sending IP, country, message count, the SPF and DKIM cells and the DMARC verdict. One source can have more than one row — one per result, each with its last seen day — so after you fix a sender its new, passing row appears with a recent date while the old row keeps its older one (in another section if the fix turned a failure into a pass). Sending sources, grouped by provider goes deeper on every part of the table and on how providers are detected.
What each mark means
The table uses a small set of marks, and they are worth learning precisely.
SPF and DKIM cells show two things each: whether the check succeeded (✓ / ✕) and whose domain it was for (= yours, ≠ someone else's, ○ none present), followed by the domain. DMARC only counts a check that both passed and is for your domain. Alignment is the part people miss; DMARC alignment explained covers why a passing check can still not count.
The DMARC column says pass for verified mail. For mail that was not verified it says what your published policy does with it:
| Tag | Meaning |
|---|---|
pass | DMARC passed — at least one check passed for your domain. |
fail · p=none | DMARC failed, but under a monitoring (p=none) policy the mail is still delivered — nothing is being blocked yet. |
would quarantine | DMARC failed and your policy is p=quarantine: receivers are asked to treat this mail as suspicious, usually the spam folder. |
would reject | DMARC failed and your policy is p=reject: receivers refuse this mail. |
Colours carry the same story at a glance: an aqua cell is a check that counted; amber cells on passing rows are information (DMARC passed anyway, nothing is rejected); red marks mail actually at risk. The fail · p=none and would quarantine verdicts are amber, would reject is red. The dot at the start of each source row is aqua, amber or red for its section — the same red used for threat countries.
Countries, the policy advisor and export
Three more cards round out the view:
- Top countries ranks sending countries by message volume, with flags and proportional bars — a country's bar turns red if threat traffic originated there. "Your" mail suddenly coming from a country you've never operated in is one of the fastest spoofing tells.
- Policy advisor shows your current published policy and the enforcement ramp —
p=nonetop=quarantine · pct=25top=reject— with "you are here" marked. The Recheck DNS button reads your live_dmarcrecord straight from DNS, so the advisor reflects what you've published right now rather than what past reports observed. - Export (top bar) downloads the current view as CSV — a per-domain summary from the overview, or the per-source table from a detail view.
The dashboard aggregates thousands of XML reports into these views; if you want to understand the raw material underneath, read How to read a DMARC report.