> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dmarceye.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Sender geolocation

> Sender geolocation in DMARCeye: see where the IP addresses sending mail in your domain's name are located, on a clustered world map — to spot traffic from regions you don't operate in and investigate possible abuse faster.

Sender geolocation — shown in your reports as **Sender Locations** — adds geographic context to your DMARC data. For each sending source, DMARCeye enriches the sending IP addresses with country and location data and plots them on a world map, so you can see where mail claiming to be from your domain is actually being sent.

## Where to find it

Sender Locations appears at the **sender** level of your reports, below the Source Summary:

<Steps>
  <Step title="Open a domain's reports">
    Go to **Reports**, or open a domain and select its **Reports** tab.
  </Step>

  <Step title="Choose a sending source">
    Scroll to **Sender Details** and click a sender (for example, your ESP or a mail provider).
  </Step>

  <Step title="Scroll to Sender Locations">
    Below the **Source Summary** and the Email Volume chart, the **Sender Locations** map shows where that sender's IP addresses are located.
  </Step>
</Steps>

## Reading the map

The map plots the geographic location of every IP address sending email on behalf of the selected source.

* **Clustering** — nearby locations are grouped into numbered markers so a large number of sources stays readable. The number on a marker is how many IP locations it represents.
* **Zoom** — use the **+ / −** controls (or scroll) to zoom in; as you zoom, clusters split into more specific locations.
* **Drill down** — open an individual IP address to see its details, including its location, alongside its authentication metrics.

## Interpreting the locations

Seeing IP addresses in many countries is normal, not a reason to panic. The location shown for an IP comes from IP geolocation — it reflects where that sending infrastructure is registered or hosted, not where a person clicked "send." Your legitimate email providers (your newsletter platform, your CRM, Google, Microsoft, and so on) run sending servers in data centers around the world, so their IPs naturally appear in several regions.

So a sender showing IPs across multiple countries is usually just a reflection of that provider's global infrastructure — on its own, it does not mean someone is spoofing your domain.

The real signal is not geography, it is **authentication**. What warrants a closer look is an unfamiliar source that is also **failing DMARC** — an IP you can't tie to any provider you use, sending mail that doesn't pass SPF or DKIM alignment. If something looks off, keep an eye on your DMARC compliance in the [reports](/understanding-your-first-reports): a genuine spoofing attempt shows up as failing authentication from a source you don't recognise, not simply as an unexpected point on the map.

For the rest of the sender drill-down, see [Source Summary](/source-summary-sender-level). For the full reports walkthrough, see [Understanding your reports](/understanding-your-first-reports).