Could you please add the ‘disposition’ field from the DMARC reports?
Besides knowing how a policy is panning out it is also useful to know what a source decided to do with your DMARC policy. The disposition tells you which filter action (reject, quarantine, none) was applied to the reported numbers.
Gmail and Outlook also look at the sender reputation and decide to deliver a message that should have been rejected by the DMARC policy. When a receiver is reporting phishing mails this statistic can support your enquiry at Google or Microsoft to resolve the problem.
Some useful insights:
- How many messages were actually delivered, rejected or quarantined.
- What percentage is delivered, quarantined, rejected overriding the DMARC policy.
- Top 10 sources with most overrides.