Applicable Products - Valimail Enforce®
When does the executive report get sent out?
The automated executive report gets sent out on a monthly basis. You should expect to receive your report on the first of every month.
Who Receives the Executive Report?
Users who meet the following criteria are auto-enrolled in the report:
Have the Owner role assigned to them
Account has at least one domain at enforcement (quarantine or reject)
Must have a subscription for Enforce®
How do I enable the Executive Report?
For Enforce® subscription accounts:
Navigate to the Enforce Settings by using the left-side panel and click on Alerts.
Under the Create a Custom Alert for Your Account section click on the Type of Alert to open the dropdown menu and select the Executive Report.
Click on Add a Custom Alert once the Executive Report is selected to begin the setup.
In the Email Address field input your business email, and optionally, use the dropdown menu under Cadence to choose how often the Executive reports are sent (Daily, Weekly, or Monthly - default).
Click Add Custom Alert.
Note: This feature is available for Enforce® Pro and Enforce® Enterprise.
What does the data mean?
Potential Phish Blocked
This shows you the number of emails across all of your enforced domains where the DMARC disposition was quarantine or reject and was not overridden. This number typically represents emails from senders that you do not allow to send email on your behalf.
If you see a high volume of blocked email, that could indicate a couple of things
You had a large-scale phishing attempt using your domain names in the last month. Don't worry, this was blocked and Valimail is doing its job
There is an uptick in the use of unapproved known email services. Seeing a large number of legitimate services being blocked could mean that a new email sender was set up but not approved through the proper channels
Authenticated
This number represents email from known Email Service Providers and your Internal Sources that are properly authenticated and passing DMARC. You'll also see a highlight of your top sending services in this section along with their respective email volume for the month. This data is important because it shows you the known good email you are delivering successfully to recipients.
Services Authenticated
This category highlights the number of known email service providers that are authenticated properly across all of your domains.
Additionally, you will see information regarding how many failing services you have on your account. If you see any services listed here that are legitimate services, you will want to investigate them to see if there are issues.
Protected Domains
This is the number of domains that have DMARC pointed to Valimail via NS record and are at DMARC enforcement (quarantine or reject). The goal is to see all of your domains represented in this number. Note: Domain enforcement status is recorded at the first of each month for these reports
Unprotected Domains
This is the number of domains that are either not at DMARC enforcement or are not pointed to Valimail via an NS record ("undelegated"). You might see a count of domains that are Blocked vs Sending with Enforcement. This means that the domain's status has been set to blocked. This puts the domain at p=reject and locks down SPF and DKIM responses, essentially not allowing any email to be sent from that domain. Note: Domain enforcement status is recorded at the first of each month for these reports
DMARC Pass Rate
This means the percentage of your total email volume that passed DMARC authentication in the past month. If you see a percentage that is 95% or above, your account is in great shape!
If you see a sudden uptrend in percentages compared to last month's report, this typically means you successfully configured high-volume sending services and they started authenticating properly sometime in the past month.
Conversely, a downtrend could indicate a few things:
Someone set up a new email service without proper approvals and skipped the authentication step
You had a major uptick of unapproved mail or phishing that caused your overall volume to spike
Possible report discrepancies
When you receive the Executive Report for the last 30 days, you might notice sometimes that the report you got on the first of the month shows a certain email volume and a certain DMARC% passing, but when you went back to look in the UI this week, the UI shows a different email volume and/or a different DMARC% of passing/failing.
The main reason for that is that we send our reports out at a certain time/date, but we may be getting DMARC reports later than that date.
DMARC aggregate reports are being sent every 24 hours, with most of them occurring in the morning usually, but some reports may be sent earlier or later that usual (it depends on the receiver's mailbox provider), which is why you may see these differences in the reports sometimes.
As always, if you have any questions about the report you received, we are just a few clicks away