Abstract: A method includes receiving, in a computer including a processor and memory, message reporting data indicating source addresses associated with email messages received by at least one receiving organization. Each source address specifies a sender of a selected one of the email messages. In the computer, outbound providers associated with the source addresses are identified. In the computer, the source addresses are classified based on the identified outbound providers. In the computer, the source addresses are aggregated based on the classification. In the computer, a report is generated including the aggregated source addresses.

Abstract: A system for processing DMARC report data includes a computer configured to collect and process DMARC reports and store aggregated data from the DMARC reports for a domain in a database schema. The computer is configured to store the aggregated data by aggregating a selected number of primary group values, subaggregating by a selected number of group values, linking aggregate sources to forensic sources to find matches, looking up records, and storing configuration issues. The computer is configured to display a user interface that allows for end users to understand DMARC report data and provide administration ability to review and manage Outbound Email Sources.