A report containing 50,000 unfamiliar failures and five failed invoices presents two different problems. Volume matters, but it does not tell you which messages were authorized or which failure most urgently affects the business. An effective sender queue combines observed authentication evidence with a verified business owner and an explicit impact assessment.
This guide proposes an operational triage method. The priority labels are recommendations, not values defined by DMARC and not a claim that a dashboard can infer revenue or authorization from an IP address.
Keep three questions separate
References: RFC 9989 §5.3.5, RFC 9989 §5.4.
First, is the stream authorized? Second, what authentication or alignment problem is supported by the evidence? Third, what consequence does it have for a legitimate workflow? Record unknown answers rather than filling them with assumptions.
A familiar provider name establishes infrastructure context, not account ownership. A large failure count establishes reported observations, not necessarily delivery loss. A passing DMARC result establishes an aligned authentication path, not that the message was wanted or harmless.
Create a compact evidence card
References: RFC 9990 §3.1.1.8, RFC 9990 §3.1.1.9, RFC 9990 §3.1.1.10, RFC 9990 §3.1.1.11.
For each issue, record the author domain, source group, evaluated identities, receiver coverage, interval and message count. Add the candidate application, verified owner, supporting log or controlled-message reference, current policy and reported disposition. Note data-quality issues and privacy restrictions.
Keep confidence separate from urgency. An unexplained change affecting a critical service may deserve urgent investigation even before its cause is confirmed. The urgency is a reason to acquire evidence quickly, not permission to claim that an unverified explanation is true.
Use a queue with explicit next actions
Put confirmed disruption to essential authorized mail at the top of the recovery queue. Next, investigate credible risks to important routes with incomplete evidence. Track confirmed unauthorized traffic in an abuse workstream, and keep unowned sources in an attribution queue. These streams can run in parallel rather than forcing all work into a single failure-count ranking.
For every item, name the next action and owner. Examples include obtaining a controlled invoice sample, confirming an application's sending account, comparing a DKIM selector with the deployment record, or checking whether a reported source is shared infrastructure. Avoid vague items such as improve DMARC score.
Compare two illustrative issues
Synthetic issue A has five failed invoice messages, a verified application owner, a recent route change and customer reports of missing invoices. Issue B has 50,000 failures from unrecognized sources with no evidence they are authorized. Investigate A immediately for recovery while preserving B for abuse analysis and control verification.
Do not solve B by adding its IPs to SPF. Do not dismiss it either: the volume may signal a relevant attack or reporting burden. If A's customer complaints cannot be tied to the reported interval, keep that relationship tentative until message or application evidence supports it. This example is a decision exercise, not an observed incident.
Define what closes each class of issue
A legitimate sender problem closes when the intended configuration is verified, representative mail shows the required aligned pass and the business owner confirms the workflow's recovery. Report-based follow-up should use comparable windows and acknowledge participating-receiver limits.
An unknown-source item closes differently: it may become an authorized sender issue, a supported unauthorized classification or a documented unresolved observation with a review trigger. Record the classification evidence and do not claim attribution beyond what it supports.
Review recurring queue entries for missing ownership, weak onboarding or unmanaged delegated DNS. The long-term improvement is a smaller gap between business intent and authentication evidence, not simply fewer red rows in a report.
Bound the conclusion and next action
For synthetic issue A, the next action is to correlate the five invoice failures with the route change and customer evidence. For B, preserve the 50,000 observations in attribution/abuse analysis without granting sending permission. Do not convert the relative counts into an automatic severity score or a confirmed attack count.