An executive risk discussion should end with a decision, not a tour of colored authentication charts. The useful question is what a finding means for an important business process and which action is justified by the evidence. Translate protocol details without replacing uncertainty with alarming or reassuring shorthand.
Separate four control statements
References: RFC 9989 §5.3.5, RFC 9989 §5.4, RFC 9990 §3.1.
Describe configuration, observed operation, exceptions and residual risk independently. Configuration might be a verified policy requesting rejection. Observed operation might be aligned authentication on representative invoice messages. An exception might be an unverified legacy sender. Residual risk includes unobserved routes and threats DMARC does not address.
RFC 9989 connects aligned authentication with domain policy; it does not certify safe message content. RFC 9990 supplies bounded receiver observations, not a complete business-delivery audit. These limits belong in the discussion because they change which conclusions are defensible.
Build the evidence card first
References: RFC 9990 §3.1.1.4, RFC 9990 §3.1.1.8, RFC 9990 §3.1.1.9.
For each finding, record the domain, service, owner, reporting interval, receiver coverage, observed count and authentication identities. Add the policy, reported disposition, source references and any controlled-message or application-log evidence. State whether ownership is verified or only suspected.
Then write the business consequence separately. For example, failed authentication on an invoice route may threaten invoice delivery. Actual unpaid invoices or lost revenue require additional business evidence. Do not multiply failed observations by invoice value and label the result realized loss.
Use a decision-sized example
Illustrative case: a report contains 24 failing observations from a newly introduced billing route. The billing owner confirms the application, and a controlled sample, under an applicable valid policy and completed authentication checks, has no aligned passing mechanism. The provider migration occurred during the same week. Customer delivery complaints have not yet been linked to those exact observations.
A defensible statement is that the new route has a verified authentication defect and a plausible risk to billing communications. The proposed action is to repair the supported signing or envelope configuration, test the actual route and verify recovery with the business owner. It is not yet defensible to say 24 invoices were lost or that the migration caused every complaint.
Present alternatives with consequences
State the preferred action, owner, expected verification evidence and decision deadline. If temporary policy relaxation is considered, identify which domains and traffic would be affected, the security trade-off, approval authority and expiry. Do not present a broad relaxation as the only possible response before diagnosing the route.
If no change is justified yet, request targeted evidence acquisition rather than a vague investigation budget. Examples include a controlled message, account ownership verification or a retained DNS change record. Identify the precise unknown that each activity will resolve.
Keep confidence and urgency distinct
A high-impact service can justify urgent investigation even when attribution is uncertain. Mark the cause as unconfirmed while accelerating evidence collection. Conversely, a well-established technical failure may be low urgency if the domain is intentionally unused and the observed traffic is verified unauthorized.
Use plain language: observed authentication failures, verified sender, reporting gap and requested receiver treatment. Avoid universal statements such as fully protected or all spoofing blocked. Close the discussion by recording the decision, accountable owner, follow-up date and evidence that will establish completion. Reopen it if the service, sender identity or reporting coverage changes.
Continue the investigation
Use the aggregate-report walkthrough for the underlying fields and the alignment diagnosis guide when raw authentication success does not satisfy DMARC.
Keep the illustration within its evidence
For the fictional 24-observation finding, retain the verified authentication defect and the unproven link to delivery complaints as separate statements. Ask for the specific route repair and recovery evidence without assigning realized loss. No incident, customer contact or policy change was executed.