Viewing Reports

MailShield processes the DMARC and TLS reports that mailbox providers send to your Reporting address, and shows who sends mail as your domains and whether it passes authentication.

Where to Find Reports

• Reports in the sidebar shows reports for every domain in the organization, on a DMARC tab and a TLS tab.
• A domain's Reports tab has DMARC, TLS and DMARC Progression. Once reporting is set up, the DMARC and TLS views open the Reports page filtered to that domain.

Reports only arrive after you've added your Reporting address to the domain's DMARC and TLS-RPT records. See Adding a Domain.

Filtering

Filter	Options
Domain	All domains, or one domain
Date range	This week, This month, Last 30 days, Last 90 days, Last 365 days, All time, or a custom range
Reporter	All reporters, or one provider (for example google.com)
Status	All statuses, Passing (90% or more of the messages that passed or failed) or Failing (less than 90%). Forwarded mail counts as neither

DMARC Reports

Aggregate reports are daily summaries from mailbox providers such as Google, Microsoft and Yahoo. Each report shows:

• Source IPs: which servers sent mail as your domain
• Volume: how many messages came from each source
• Authentication results: SPF and DKIM results, and whether they aligned
• Disposition: what the receiver did with the mail (delivered, quarantined or rejected)

Report List and Details

The DMARC Reports list shows each report's reporter, date range, message count, forwarded messages and pass rate. Open a report to see its records per source IP, with the DKIM and SPF results and the disposition. Records forwarded from a mailbox such as Gmail or Outlook are marked Forwarded.

Mail forwarded from mailbox providers counts as neither passed nor failed, so passed, failed and forwarded add up to the message count. The pass rate is passed messages out of passed plus failed, and the Volume Trends chart shows forwarded mail as a separate dashed line. See Forwarded Mail for how MailShield recognizes it.

Sending Sources

The Sending Sources table groups the selected date range by sending IP, across all matching reports. It shows each source's message count, pass rate and status, so you can spot services that still need SPF or DKIM, and mail you don't recognize.

Sources that only forwarded mail from someone's mailbox are marked Forwarded and listed last: there's nothing to fix. A server that sends your own mail and also forwarded some is judged on your own mail only.

DMARC Progression

Reports → DMARC Progression on a domain checks whether the domain is ready for a stricter DMARC policy. It lists known sources that still fail, so you can fix them before you enforce. Forwarded mail is left out of its alignment rate and checks, and listed in a collapsed Forwarded mail section. See the DMARC Enforcement Roadmap.

Forensic Reports

Forensic (failure) reports describe individual failed messages. Many providers no longer send them for privacy reasons. MailShield stores forensic reports sent to your Reporting address, but doesn't show them in the dashboard.

TLS Reports

TLS reports (TLS-RPT) show how other mail servers fared when they connected to yours:

• Successful connections: TLS sessions that worked
• Failed connections: sessions that failed, with the failure type
• Policy: whether an MTA-STS or DANE policy applied

Open the TLS tab to see reports by date and reporter. For the failure types, see TLS-RPT.

Understanding Authentication Results

Pass and Fail

Result	Meaning
Pass	The message passed SPF or DKIM, aligned with the From domain
Fail	Neither SPF nor DKIM passed with alignment: spoofing, or a sender that isn't set up yet
Forwarded	Forwarded from a mailbox such as Gmail or Outlook, where SPF fails by design. Counts as neither pass nor fail

Alignment

DMARC requires alignment between the authenticated domain and the From header:

• SPF alignment: the envelope sender (MAIL FROM) domain matches the From domain
• DKIM alignment: the DKIM d= domain matches the From domain

Alignment can be:

• Relaxed (default): subdomains of the same domain count as a match
• Strict: the domains must be identical

Identifying Issues

Legitimate Failures

Not all failures are attacks. Common legitimate causes:

1. A service you use isn't set up yet. Fix: set up DKIM for it, and SPF if needed. See Third-Party Senders.
2. Forwarded mail breaks SPF. Mail forwarded from mailbox providers such as Gmail and Outlook is marked Forwarded and left out of pass rates, so it needs no fix. Don't add those providers to your SPF record for it. Other forwarders, such as a university's mail server, still show as failures. Fix: make sure your mail carries an aligned DKIM signature, which usually survives forwarding.
3. Mailing lists change the message. Expect some failures from lists.

Potential Attacks

Signs of spoofing:

• High volume from IPs you don't recognize
• Sources with no link to any service you use
• Failures from networks known for spam

Report Timing

• DMARC aggregate reports: usually daily, each covering the previous 24 hours
• TLS reports: usually daily

TIP

Your first reports usually arrive 24-48 hours after you configure reporting, once providers have seen mail from your domain.

Exporting and Sharing

There's no CSV or JSON export of report data. To share results:

• Download a PDF report for a domain from its Overview.
• On Pro, download the Customer report (PDF) from the Reports page, or set up scheduled reports.
• Use the API (Pro) to fetch report data.