A holiday campaign, tax notice or membership renewal can change both mail volume and the mix of sending services. Comparing that event with a quiet week may produce a dramatic alert even when authentication behavior is unchanged. The reverse is also possible: a large legitimate campaign can hide a smaller critical failure inside an improved overall percentage.
Build a baseline that describes the mail being compared. This is an investigation technique, not a protocol-defined scoring formula. RFC 9990 provides observation intervals, counts, authentication results and policy information; business context comes from the organization's own sending calendar and records.
Annotate the event before launch
Record the campaign or business process, expected From domains, sending applications, owners, launch window and intended recipient groups. Obtain the application's current authentication design and test it before the event. Do not infer authorization from an IP address appearing in a previous holiday report.
Note migrations, new providers and changes to DKIM identity or return-path. A recurring event with a new mail platform is not technically identical to last year's event, even if the marketing name and audience remain the same.
Compare equivalent observations
References: RFC 9990 §3.1.1.4, RFC 9990 §3.1.1.8, RFC 9990 §3.5.4, RFC 9989 §5.3.8.
Compare complete reporting intervals with similar receiver coverage. Keep source groups, author domains and authentication paths separate where the data supports them. Report both absolute failures and the failure proportion within the relevant stream.
Exclude or annotate incomplete intervals rather than treating a partial day as a sudden drop. Preserve late arrivals and duplicate-handling decisions. A newly contributing receiver can increase visible traffic without any change in actual sending. A receiver disappearing from the data can make the overall rate look better without a sender being repaired.
Work through a seasonal mix change
Illustrative baseline: a quiet week has 1,000 staff messages with 10 failures, a one percent observed rate. During a campaign week, the same staff stream has 20 failures among 1,000 messages, while a campaign adds 9,000 passing messages. The overall rate is now 20/10,000, or 0.2 percent, even though staff-stream failures doubled.
Keep the two stream results and business impact visible. These synthetic figures demonstrate how a changing denominator can hide a regression; they are not production measurements. Attribution to a particular application requires supporting ownership and message evidence, not just convenient grouping by IP.
Investigate differences before changing thresholds
References: RFC 9990 §3.1.1.9, RFC 9990 §3.1.1.11, RFC 9989 §5.3.5.
For a changed stream, compare the receiver-observed policy and SPF/DKIM identities with the planned sender configuration. Determine whether authentication failed, alignment failed, or only reported disposition changed. With an applicable valid policy and completed checks, one aligned passing mechanism can satisfy the message-level DMARC rule even when the other fails.
Use the application owner's launch or migration record to test the explanation. A volume increase near a holiday is not enough to classify unknown traffic as a campaign. Conversely, do not suppress a new failure simply because the calendar predicts high volume.
End with an event-specific review
Set a temporary alert review window, owner and expiry for the event. If thresholds are adjusted, record the reason and maintain an independent check for critical routes or new unknown sources. Restore the normal review arrangement after the event instead of leaving a permanent blind spot.
Retain a concise event summary: compared periods, receiver coverage, relevant counts, changed routes, representative tests and unresolved questions. Next season, use that summary as context, then verify current configuration again. The baseline should help an analyst recognize a meaningful change without treating last year's traffic as permanent authorization.
Bound the conclusion and next action
The local synthetic arithmetic confirms staff failures rise from 10/1,000 = 1% to 20/1,000 = 2%, while the combined campaign-week rate falls to 20/10,000 = 0.2%. Investigate the staff regression rather than infer improvement from the blended rate. No campaign, actual receiver cohort or alert threshold was measured or changed.