[ Reports & investigation ]
Report delivery failures caused by mail routing or filtering
Locate a missing aggregate report between DNS, SMTP receipt, quarantine and parsing.
By the EmailAuth research team
[ Key points ]
- Find the last stage with positive evidence.
- SMTP acceptance does not establish successful parsing.
- Restore the failed stage without inflating report totals.
[ Takeaway ]
Restore the failed stage without inflating report totals.
[ By role ]
What this means for you
Choose your role for practical next steps.
IT / Mail Admin
Trace SMTP through parser output.
Preserve the underlying observations and use the workflow above to separate the actual failure stage from assumptions.
Next steps
- Trace SMTP through parser output.
- Preserve the failing report fixture.
- Verify fresh end-to-end ingestion.
CISO / SecOps
Keep report processing sandboxed.
Keep coverage, provenance and remaining uncertainty visible before relying on these findings for a security decision.
Next steps
- Keep report processing sandboxed.
- Review narrowly scoped filter exceptions.
- Record uncertainty during lost coverage.
Founder / Non-technical
Assign the collection incident owner.
Connect this reporting task to an owned business decision and require evidence proportionate to its impact.
Next steps
- Assign the collection incident owner.
- Identify decisions affected by missing evidence.
- Require restoration and gap reporting.
[ FAQs ]
Frequently asked questions
Does an empty dashboard prove SMTP delivery failed?
No. The failure may be generation, receipt, filtering, parsing or display.
Does a normal test email prove report ingestion?
No. It tests a narrower route without necessarily exercising report attachments and parsing.
What does SMTP acceptance prove?
Acceptance by that server, not completion of every downstream processing stage.
Should report attachments bypass all security checks?
No. Apply a narrow reviewed fix and retain protections for untrusted input.
Why keep the original attachment?
It supports diagnosis, reproducible parser tests and audit of later transformations.
Will failed reports always be resent?
No. RFC 9990 permits retry or discard when delivery is unavailable.
Should DMARC policy change to repair a mailbox?
Not merely for that purpose. Repair the affected collection stage.
[ Sources ]
Sources
[ Glossary ]
Glossary
- DMARC alignment
- The required relationship between the visible From domain and a passing SPF or DKIM identity. Strict alignment requires an exact domain match; relaxed alignment uses the applicable organisational-domain relationship.
- Author Domain
- The domain in the message's visible From address that DMARC evaluates.
- DMARC
- Domain-based Message Authentication, Reporting, and Conformance connects aligned authentication with domain-owner policy and feedback. It does not certify message content or guarantee delivery.
- Aggregate report
- A receiver's grouped DMARC observations for a reporting interval. It does not necessarily represent every message an organisation sent.
Enterprise provenance
Why top financial institutions and governments retired their email security dashboards.
Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.
EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.
SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption