Level: Advanced
Aggregate reports are the primary technical tool for understanding exactly which sources are sending mail as your domain and whether they're passing authentication.
Reports Arrive as Structured XML From Receiving Providers
Major mailbox providers periodically send aggregate reports summarizing authentication results for mail claiming to originate from your domain, broken down by sending IP.
Look for Unexpected Sending Sources First
An IP address in the report that you don't recognize as a legitimate sending source is either a previously undocumented internal system or a genuine spoofing attempt, both worth investigating immediately.
Track Pass Rates Over Time, Not Just a Single Report
A single report is a snapshot; tracking authentication pass rates across multiple reporting periods reveals trends and confirms whether configuration changes are actually improving alignment.
Next step: Use the SeoWolf's Notepad to log your key findings from each aggregate report review in one place to track trends over time.