This document describes the DMARC report from CMC Domain Protection, explaining its content and how to interpret it. The report shows the DKIM and SPF authentication results for emails originating from your domain and indicates DMARC authentication success. This information is crucial for understanding and mitigating email spoofing.
To access the DMARC reports, log in to the CMC Domain Protection management console and navigate to the "Reports" tab. You will find three types of reports.
Summary
Weekly tally
Daily tally
Common search items
In all report tabs, you can filter the reports displayed by the following items:
Organizational Domain: Select the organization domain you want to monitor.
Header From Domain: Select the From domain of the header of the sent email. Use this when you want to narrow down the analysis to a specific From address domain.
Target period: Select the collection period for the DMARC report. You can select the statistical period for the past 3 months.
Summary
On the "Summary" tab, you can check the DMARC authentication rate for the selected organization domain, header "From" domain, and sending organization domain for the target period.
Additionally, this screen allows you to view, configure, and perform bulk updates for Sender flags.
Prerequisites for Display and Operation: To display or edit Sender flags, you must first filter the results by selecting a specific "Header-from domain" in the search criteria at the top of the screen. If "All Domains" is selected, Sender flag information and operation buttons will be disabled.
Note
The sender organizational domain is the domain obtained by reverse DNS lookup
of the sending server IP address. It is usually the organization domain
(e.g.smtps.jp, google.com) will be displayed, and if the URL is unknown,
a hyphen (-) will be displayed.Also,If the value is greater than "0" percent
and less than "1" percent, it is displayed as "< 1%."
Item | Description |
|---|---|
Service Name | This is the name of the service (e.g., Google, Microsoft 365, Salesforce, etc.) that actually delivered the email, which the system automatically identifies based on the source IP address (sending service domain) of the DMARC report.If it is not registered in the identification criteria, a hyphen ("-") will be displayed. |
Sender Organizational Domain | This indicates the organizational domain (the domain one level below the top-level domain (TLD)) that is obtained by DNS reverse lookup of the sender IP address. If there is no reverse lookup, a hyphen (-) is displayed. |
Sender flag | This shows the sender flag. Filtering the data view by sender flag, such as 'Legitimate Sender' or '-', is also available. |
Count | The total number of emails processed during the period covered. |
DMARC Pass | This indicates the percentage of emails that passed DMARC authentication. |
DKIM alignment Pass | This shows the percentage of emails that passed DMARC DKIM authentication. For DMARC evaluation, the DKIM signature must be aligned (matched or related) with the From header domain. |
SPF alignment Pass | This represents the percentage of emails that passed only DMARC SPF authentication. DMARC evaluation requires that the SPF-authenticated envelope From domain is aligned (matched or related) to the header From domain. |
DKIM Pass | This represents the percentage of emails that have been successfully authenticated by DKIM, regardless of the DMARC evaluation. Even if the alignment (matching or relevance) required for DMARC authentication is not achieved, it will be counted as long as the DKIM authentication itself is successful. |
SPF Pass | This represents the percentage of emails that passed SPF authentication, regardless of the DMARC evaluation. Even if the alignment (match or relevance) required for DMARC authentication is not achieved, it will be counted as long as the SPF authentication itself is successful. |
About Sender Flag
This feature allows you to set and manage the "Legitimate Sender" flag for specific combinations of Header From domains and Sender organizational domains. By identifying only authorized senders, you can verify accurate DMARC authentication rates while excluding forwarded emails and spoofing. (Note: This setting is independent of the "Domain Status" found on the dashboard.)
1. Displaying (Enabling) the "Sender Flag" Column
Filtering by a specific 'Header From Domain' enables the checkboxes and edit buttons required to manage sender flags.
2. Setting and Changing Sender Flag
Sender Flag can be assigned to sender organizational domains either individually or in bulk.
Individual Settings：Click the pencil icon to the left of the record you wish to modify. In the detail screen, select "Legitimate Sender" or "-" (Unset) from the "Sender Flag" menu and click save.
Bulk Settings：Use the checkboxes to the left of the record to select multiple items. Apply the desired flag through the "Bulk Actions" menu that appears at the bottom of the screen.
3. Filtering Report by Flags
You can use assigned flags to extract and review only the data you need.
Filtering in the List View： Click the filter icon in the "Sender Flag" column to display only the data assigned with a specific flag.
Use in Reports:： Filtering by "Sender Flag" is also available in both weekly and daily aggregated reports. This allows you to limit your analysis to legitimate senders for more detailed reporting.
4. Dashboard Analysis
Sender flag can be utilized within the "Advanced Search" on the dashboard. This enables you to monitor DMARC authentication rate trends specifically for your "Legitimate Senders”.
Downloading data for analysis
The analysis data is DMARC reports (rua reports) converted to CSV format with the information necessary for improving DMARC policies added. By downloading it, you can analyze it in more detail using tools such as Excel or create your own reports. For more information on the analysis data, please see Download data Please check.
Weekly report
The "Weekly" tab displays the weekly summary of DMARC authentication results for the selected organization domain, header "From" domain, and sending organization domain for the target period.
Notice
The target period for weekly calculations is a period that starts on
Sunday and ends on Saturday. Therefore, only periods that start on
Sunday and end on Saturday can be selected as the search period.
Item | Description |
|---|---|
Data period | Represents the period covered by the aggregation (weekly: starting on Sunday and ending on Saturday). |
Service Name | This is the name of the service (e.g., Google, Microsoft 365, Salesforce, etc.) that actually delivered the email, which the system automatically identifies based on the source IP address (sending service domain) of the DMARC report.If it is not registered in the identification criteria, a hyphen ("-") will be displayed. |
Header-from Domain | This represents the From header domain of the outgoing email as listed in the DMARC report. |
Sender Organizational Domain | The domain obtained by reverse DNS lookup of the sender IP address is the organization domain (top domain) If there is no reverse lookup, a hyphen (-) is displayed. |
Sender flag | This shows the sender flag. Filtering the data view by sender flag, such as 'Legitimate Sender' or '-', is also available. |
Count | The total number of emails processed during the period covered. |
Policy (apply/publish) | It represents the enforcement policy (the policy that has actually been enforced) and the published policy that has been published in DNS. |
DMARC results | Represents the DMARC authentication result. |
DKIM results (alignment/normal) | This shows the DKIM authentication result from the DMARC perspective and the regular DKIM authentication result. |
SPF results (alignment/normal) | This shows the SPF authentication result from the DMARC perspective and the normal SPF authentication result. |
DKIM Selector | The DKIM selector name used for DKIM authentication. |
DKIM Domain | The DKIM domain name used for DKIM authentication. |
SPF Domain | The domain name used for SPF authentication. |
Forwarded (ARC) | If the DMARC report contains messages that were excluded from forwarding due to ARC or other reasons, Yes will be displayed. |
Daily report
The "Daily" tab displays the DMARC authentication results for the selected organization domain, header "From" domain, and sending organization domain on a daily basis for the target period.
The main summary items are almost the same as the weekly summary report, but the Sender IP address and country code are added.
Item | Description |
|---|---|
Statistical day | Indicates the date for which the calculation is performed. |
Header-from domain | Represents the From domain in the outgoing email header. |
Country Code | Represents the country to which the sender's IP address belongs. |
Sender IP address | Represents the source IP address. |
Service Name | This is the name of the service (e.g., Google, Microsoft 365, Salesforce, etc.) that actually delivered the email, which the system automatically identifies based on the source IP address (sending service domain) of the DMARC report.If it is not registered in the identification criteria, a hyphen ("-") will be displayed. |
Sender Organizational Domain | This indicates the organizational domain (the domain one level below the top-level domain (TLD)) that is obtained by DNS reverse lookup of the sender IP address. If there is no reverse lookup, a "- (hyphen)" is displayed. |
Sender flag | This shows the sender flag. Filtering the data view by sender flag, such as 'Legitimate Sender' or '-', is also available. |
Count | The total number of emails processed during the period covered. |
Policy (apply/publish) | Represents enforcement and publishing policies. |
DMARC Results | Represents the DMARC authentication result. |
DKIM results (alignment/normal) | This shows the DKIM authentication results from the DMARC perspective and the regular DKIM authentication results listed in the DMARC report. |
SPF results (alignment/normal) | This shows the SPF authentication result from the DMARC perspective and the regular SPF authentication result described in the DMARC report. |
DKIM Selector | DThis shows the DKIM selector name used for DKIM authentication listed in the DMARC report. (Representative value: If there are multiple values, the representative value is the record with the closest DKIM domain to the From domain in the header.) |
DKIM Domain | This shows the DKIM domain name used for DKIM authentication listed in the DMARC report. (Representative value: If there are multiple values, the representative value is the record with the closest DKIM domain to the From domain in the header.) |
SPF Domain | This represents the domain name used for SPF authentication as listed in the DMARC report. |
Forwarded (ARC) | If the DMARC report contains messages that were excluded from forwarding due to ARC or other reasons, Yes is displayed. |
These reports can help you understand the following information and move forward with upgrading your DMARC policy (from p=none to p=quarantine to ultimately p=reject):
Check for email senders that your company does not recognize
Identifying the source of spoofed emails
Check and improve the authentication status of legitimate email senders (DKIM, SPF success rate)
Identifying mail servers that do not support sending domain authentication
Upgrading your DMARC policy may require specialized knowledge of DMARC and coordination with internal and external parties. HENNGE offers "Advisory Services (Consulting)" in such cases to ensure smooth DMARC implementation and policy upgrades.
We support:
Download data
Analysis data By clicking the "Download data for analysis" button in the upper right corner of the summary screen, you can download the data for analysis as a ZIP file containing a CSV.
The downloaded CSV file will contain the following header columns:
Note
A data source refers to the source from which data is obtained.
rua report: Values taken directly from the DMARC RUA report
Extension: Value verified and calculated by CMC Domain Protection
based on the RUA report
Header Column Name | Data Source | Description |
|---|---|---|
meta_org_name | rua Report | Report sending organization name |
ext_org_name_domain | Expansion | Report sending organization domain |
ext_report_date | Expansion | Report Date |
ext_file_name | rua Report | Report File Name |
rec_row_sip | rua Report | Source IP address |
ext_rec_row_sip_ptr | Expansion | Sender Organizational Domain |
dmarcrecordid | Expansion | Internal ID |
ext_registered | Expansion | DMARC setting registered domain |
dmarc_report_id | Expansion | Internal ID |
dmarc_report_record_id | Expansion | 内Internal ID |
version | rua Report | Report Version |
meta_report_id | rua Report | Report ID |
meta_dtrange_begin | rua Report | Report period start date and time |
meta_dtrange_end | rua Report | Report period end date |
meta_email | rua Report | Report sender email address |
meta_extra_contact | rua Report | Add report sendercontactFirst |
meta_error | rua Report | Error Message |
polpub_domain | rua Report | Public Domain |
polpub_adkim | rua Report | Public DKIM Alignment Mode |
polpub_aspf | rua Report | Public SPF alignment mode |
polpub_p | rua Report | Disclosure Policy |
polpub_sp | rua Report | 公Public Subdomain Policy |
polpub_pct | rua Report | 公Public policy enforcement rate |
polpub_fo | rua Report | Publishing failure reporting options |
polpub_np | rua Report | 公Public Non-existent Subdomain Policy |
rec_row_cnt | rua Report | Number of emails |
rec_row_poleval_disp | rua Report | Applicable policies |
rec_row_poleval_dkim | rua Report | DKIM authentication results (DMARC) |
rec_row_poleval_spf | rua Report | SPF authentication result (DMARC) |
rec_row_poleval | rua Report | Policy enforcement reason type |
rec_row_poleval | rua Report | Policy application reason comment |
rec_id_env_to | rua Report | Envelope To |
rec_id_env_from | rua Report | Envelope From |
rec_id_header_from | rua Report | Header From |
rec_auth_spf_domain | rua Report | SPF verified domain |
rec_auth_spf_scope | rua Report | SPF Verification Scope |
rec_auth_spf_result | rua Report | SPF authentication result(Normal) |
ext_rec_auth_dkim_cnt | Expansion | Number of DKIM elements |
rec_auth_dkim_domain | rua Report | DKIM Verification Domain |
rec_auth_dkim_selector | rua Report | DKIM Verdict Selectors |
rec_auth_dkim_result | rua Report | DKIM authentication results(Normal) |
rec_auth_dkim | rua Report | DKIM Verification Results Supplement |
ext_is_from_cmc | Expansion | Customers Mail Cloud Send Flag |
ext_is_sip_expected | Expansion | SPF Origin Verification Flag |
ext_rec_row_sip_country | Expansion | Country Code |
ext_rec_row_sip | Expansion | Sender Organizational Domain |
ext_rec_row_poleval | Expansion | DMARC authentication results |
ext_rec_type | Expansion | Record Type |
ext_reverse_header_from | Expansion | Reverse Header From |
ext_service_name | Expansion | Service NameThis field represents the reversed order of each part of the domain name in the Service Name field. |
ext_domain_status | Expansion | Domain Status |
ext_legitimate_sender | Expansion | Sender Flag |
Weekly aggregate data
Click the "Download" button in the upper right corner of the weekly summary screen to download the currently displayed weekly summary data (data narrowed down by search criteria) as a ZIP file containing a CSV.
The downloaded CSV file will contain the following header columns:
Header Column Name | Screen Items |
|---|---|
Start Date | Data period (start date) |
End Date | Data period (end date) |
Header From | Header-from Domain |
Sender Organizational Domain | Sender Organizational Domain |
Legitimate Sender | Sender Flag |
Message Count | Count |
Evaluated Policy | Policy (apply) |
Published Policy | Policy (publish) |
DMARC Result | DMARC results |
DMARC: DKIM Result | DKIM results (alignment) |
DKIM Result | DKIM results (normal) |
DMARC: SPF Result | SPF Results (alignment) |
SPF Result | SPF results (normal) |
DKIM Selector | DKIM Selector |
DKIM Domain | DKIM Domain |
SPF Domain | SPF Domain |
Forwarded | Forwarded (ARC) |
Daily aggregate data
Click the "Download" button in the upper right corner of the daily summary screen to download the currently displayed daily summary data (data narrowed down by search criteria) as a ZIP file containing a CSV.
The downloaded CSV file will contain the following header columns:
Header Column Name | Screen Items |
|---|---|
Date | Statistics day |
Header From | Header-from domain |
Sender Country | Country Code |
Sender IP Address | Sender IP address |
Sender Organizational Domain | Sender Organizational Domain |
Legitimate Sender | Sender Flag |
Evaluated Policy | Policy (apply) |
Published Policy | Policy (publish) |
Message Count | Count |
DMARC Result | DMARC results |
DMARC: DKIM Result | DKIM results (alignment) |
DKIM Result | DKIM results (normal) |
DMARC: SPF Result | SPF Results (alignment) |
SPF Result | SPF results (normal) |
DKIM Selector | DKIM Selector |
DKIM Domain | DKIM Domain |
SPF Domain | SPF Domain |
Forwarded | Forwarded (ARC) |
