Abstract: A method includes receiving, in a computer including a processor and memory, message reporting data indicating source addresses associated with email messages received by at least one receiving organization. Each source address specifies a sender of a selected one of the email messages. In the computer, outbound providers associated with the source addresses are identified. In the computer, the source addresses are classified based on the identified outbound providers. In the computer, the source addresses are aggregated based on the classification. In the computer, a report is generated including the aggregated source addresses.

Abstract: A method includes receiving, in a computer including a processor and memory, message reporting data indicating source addresses associated with email messages received by at least one receiving organization. Each source address specifies a sender of a selected one of the email messages. In the computer, outbound providers associated with the source addresses are identified. In the computer, the source addresses are classified based on the identified outbound providers. In the computer, the source addresses are aggregated based on the classification. In the computer, a report is generated including the aggregated source addresses.

Abstract: A system for processing DMARC report data includes a computer configured to collect and process DMARC reports and store aggregated data from the DMARC reports for a domain in a database schema. The computer is configured to store the aggregated data by aggregating a selected number of primary group values, subaggregating by a selected number of group values, linking aggregate sources to forensic sources to find matches, looking up records, and storing configuration issues. The computer is configured to display a user interface that allows for end users to understand DMARC report data and provide administration ability to review and manage Outbound Email Sources.

Abstract: A platform and methods to collect, process, aggregate, display, and trigger or signal actions for DMARC report data to improve the way computers operate with respect to email. The platform includes the following functionalities: (a) A DMARC report ingestion mechanism to collect and process DMARC reports; (b) A database schema to store aggregated data from DMARC reports for a domain; (c) A user interface that allows for end users to understand DMARC report data; (d) Administration ability to review and manage Outbound Email Sources; (e) A method to automatically adjust DMARC and SPF records based on DMARC data; and (f) A method to elicit and generate threat sources and signatures.

Abstract: An email address may be associated with more than one inbox on more than one server. An email sent to such an address may not be delivered automatically to all the inboxes because mail transfer agents follow a rule that each email address is uniquely associated with one inbox on one server, so such agents stop after delivering email to the first inbox. A switching mail transfer agent processes email to deliver to more than one inboxes associated with the address substantially synchronously and substantially without duplicates being delivered to the same inbox.

Abstract: An email address may be associated with more than one inbox on more than one server. An email sent to such an address may not be delivered automatically to all the inboxes because mail transfer agents follow a rule that each email address is uniquely associated with one inbox on one server, so such agents stop after delivering email to the first inbox. A switching mail transfer agent processes email to deliver to more than one inboxes associated with the address substantially synchronously and substantially without duplicates being delivered to the same inbox.