Abstract: A method includes receiving, in a computer including a processor and memory, message reporting data indicating source addresses associated with email messages received by at least one receiving organization. Each source address specifies a sender of a selected one of the email messages. In the computer, outbound providers associated with the source addresses are identified. In the computer, the source addresses are classified based on the identified outbound providers. In the computer, the source addresses are aggregated based on the classification. In the computer, a report is generated including the aggregated source addresses.

Abstract: A method includes receiving, in a computer including a processor and memory, message reporting data indicating source addresses associated with email messages received by at least one receiving organization. Each source address specifies a sender of a selected one of the email messages. In the computer, outbound providers associated with the source addresses are identified. In the computer, the source addresses are classified based on the identified outbound providers. In the computer, the source addresses are aggregated based on the classification. In the computer, a report is generated including the aggregated source addresses.

Abstract: A system for processing DMARC report data includes a computer configured to collect and process DMARC reports and store aggregated data from the DMARC reports for a domain in a database schema. The computer is configured to store the aggregated data by aggregating a selected number of primary group values, subaggregating by a selected number of group values, linking aggregate sources to forensic sources to find matches, looking up records, and storing configuration issues. The computer is configured to display a user interface that allows for end users to understand DMARC report data and provide administration ability to review and manage Outbound Email Sources.

Abstract: A platform and methods to collect, process, aggregate, display, and trigger or signal actions for DMARC report data to improve the way computers operate with respect to email. The platform includes the following functionalities: (a) A DMARC report ingestion mechanism to collect and process DMARC reports; (b) A database schema to store aggregated data from DMARC reports for a domain; (c) A user interface that allows for end users to understand DMARC report data; (d) Administration ability to review and manage Outbound Email Sources; (e) A method to automatically adjust DMARC and SPF records based on DMARC data; and (f) A method to elicit and generate threat sources and signatures.