Orillon Cyber

DMARC enforcement

How to interpret DMARC aggregate reports

Turn authentication XML into decisions about real and unknown senders.

9 minute readUpdated October 16, 2026

What aggregate reports contain

Reports normally group source IPs, message counts, disposition and SPF or DKIM authentication outcomes. They do not reproduce ordinary message bodies.

Classify before changing policy

A source IP alone may represent shared infrastructure. Combine provider ownership, DKIM domains and business context before deciding what it is.

  • Known provider and expected business process
  • Known provider but incorrect alignment
  • Forwarded or mailing-list traffic
  • Obsolete sender that should be retired
  • Unknown or unauthorized source

Review trends, not one isolated row

Volume, recurrence and alignment changes over time are more useful than a single report. Validate low-volume systems such as payroll or annual notices before enforcement.