Skip to main content

DMARC Grafana Dashboard

Audience: Email Security Administrators and Security Analysts.

Purpose: Interpret DMARC aggregate reports using the Grafana dashboard.

Overview​

The DMARC Grafana dashboard provides visibility into DMARC aggregate reports (RUA reports), helping identify authentication issues and unauthorized senders.

Dashboard Sections​

DMARC Summary​

Three pie charts showing pass/fail percentages for:

  • SPF Alignment
  • DKIM Alignment
  • DMARC Overall

Over Time Graphs​

GraphPurpose
SPF/DKIM Over TimeAuthentication pass/fail trends
SPF/DKIM Alignment Over TimeAlignment pass/fail trends
DMARC/Disposition Over TimePolicy enforcement trends

Disposition values:

  • none — Policy not applied, email delivered
  • quarantine — Email quarantined
  • reject — Email rejected

Total Message Count​

Total number of messages from parsed DMARC reports.

Reporting Tables​

Reporting Organizations​

Organizations sending you DMARC reports.

Top 2000 Message Sources by Reverse DNS​

Sending servers grouped by base domain in reverse DNS.

Message Volume by Header From​

Email from domains sorted by message volume.

Geographic Data​

A world map showing message origin countries with corresponding message counts.

Overview Table​

ColumnDescription
Sending DomainDomain of sending MTA/SEG
PTRReverse DNS of sending server
Source IPIP of sending server
CountryCountry of sending server
DispositionDMARC policy action taken
SPFSPF alignment status
DKIMDKIM alignment status
ReporterOrganization that sent the report
SPF Auth ResultSPF authentication pass/fail
DKIM Auth ResultDKIM authentication pass/fail
Email DomainRFC5322.From domain
MessagesMessage count

Published Policies Table​

ColumnDescription
DomainDomain for DMARC policy lookup
DKIM Policyadkim field — s (strict) or r (relaxed)
SPF Policyaspf field — s (strict) or r (relaxed)
Policyp field — none, quarantine, or reject
Percentagepct field — default 100
Subdomain Policysp field — none, quarantine, or reject

Alignment Details​

SPF Alignment Table​

ColumnDescription
Header FromRFC5322.From domain
Envelope FromRFC5321.MailFrom (Return-Path)
SPF ResultAuthentication pass/fail
SPF AlignedAlignment status

DKIM Alignment Table​

ColumnDescription
Header FromRFC5322.From domain
DKIM Selectors= field for public key lookup
DKIM Domaind= field for public key lookup
DKIM ResultSignature validation pass/fail
DKIM AlignedAlignment status

Analysis Tips​

Identifying Unauthorized Senders​

  1. Look at Message Sources by Reverse DNS table
  2. Find senders you don't recognize
  3. Use filter tools (magnifying glass icons) to drill down
  4. Cross-reference with Message From Header table

Finding DKIM Configuration Needs​

  1. Find a recognized sender (e.g., email marketing service)
  2. Hover and click + magnifying glass to filter
  3. Check Message From Header to see which domains use the service
  4. Contact those departments to set up DKIM

DMARC Alignment Quick Reference​

MechanismPassingAlignment
DKIMSignature validated using published public keyd= domain matches From header
SPFServer IP listed in SPF recordEnvelope From matches From header
Pass Requirement

A message passes DMARC by passing DKIM or SPF, as long as the related indicators are also aligned.