Every mailbox provider that receives mail claiming to be from a domain files a daily report: how much passed SPF and DKIM, and from which addresses. This hub collects those reports for the whole fleet, groups the senders into ones we recognize and ones we do not, and says plainly when a domain is configured in a way that produces no reports at all.
A DMARC record with no reporting address enforces policy and shows you nothing. That is the state most domains quietly sit in, and it is the first thing this hub reports on.
An address nobody recognizes sending as a client domain shows up in the unknown-senders list the next morning, with volume and pass rate attached.
Something that has been sending unsigned for a year is invisible until a report names it. Then it is a five-minute fix instead of a mystery.
Missing rua, a policy with no teeth, an SPF record past the ten-lookup limit, or a report destination that never authorized us to receive on its behalf.
Sixty-odd sites share one sending reputation. One domain being abused is everyone's problem, so the fleet view comes before the per-domain one.
Every monitored domain publishes rua=quarantine@hokedesigns.com. Because that address
lives on a different domain from most of the ones being reported on, each domain also needs an
authorization record in the hokedesigns.com zone — the step that is easy to miss
and that silently stops Microsoft and Yahoo from sending anything at all.
A DMARC record with a reporting address, and the matching _report._dmarc authorization record on the destination domain.
Reports arrive as compressed XML once a day per provider. They are unpacked, parsed and stored exactly once; anything unreadable is kept for inspection rather than dropped.
Each source address is resolved to a reverse hostname and network, then matched to a known sender — or flagged as one we do not recognize.
Findings feed the monitoring hub for alerting and the hosting hub for client reporting, so nothing has to be checked by hand to be noticed.