When you drill into a specific sender (for example, Mailchimp), the right-hand panel shows a Source Summary with aggregated statistics for that sender.
| Metric | Example | Description |
|---|
| Active IP Addresses | 86 | The number of unique IPs that sent email as this sender during the selected period. |
| Average DMARC Compliance | 99% | The mean compliance rate across all IPs for this sender. |
| Peak Volume | 19,598 Emails | The highest single-day volume seen from this sender in the period. |
| Authentication Method | DKIM Primary | Indicates whether DKIM or SPF is the primary passing authentication method. |
Email Volume Over Time Chart
The bar chart shows daily email volume reported during the selected period. Each bar represents one day. The colour of the bar indicates authentication health:
- Green bars — all emails from that day passed DMARC.
- Red bars — one or more emails failed DMARC on that day.
- Teal/mixed bars — a mix of passing and failing emails.
Hovering over any bar shows a tooltip with two values: Valid DMARC (number of emails that passed) and Invalid DMARC (number that failed). This chart is available at all three drill-down levels: domain, sender, and IP address.
Tip: A sudden spike in volume combined with a compliance drop is a strong signal of either a spoofing campaign or an infrastructure change that broke authentication. Investigate spikes first.
Sender Locations
Below the Source Summary and the Email Volume chart, the Sender Locations map shows where this sender’s IP addresses are located. See Sender Locations. 
