Detailed per-record view of email sources for a domain with flexible grouping and filtering.
Grouping (group_by, default: "isp"):
• "isp" — by ISP/provider (shows ISP, hostname, brand domain, country). Best starting point for investigation.
• "ip" — by sending IP address (shows IP, ISP, PTR, country, source type)
• "host" — by hostname (ip_domain_name)
• "reporter" — by DMARC report sender (shows reporter organization)
Note: with group_by=isp, the same provider may appear multiple times with different countries — this is correct (one row per provider+country combination).
Each row includes: message count, disposition, policy override, SPF/DKIM/DMARC evaluation, SPF auth details (return-path, result, scope), DKIM auth details (domain, selector, result).
sourceReason / sourceReasonText — WHY the classifier put the source into known / unknown / forward, in the words the web app uses. This is the field that turns "unknown" into an action: no_auth_pass means hunt for the sender (or treat it as spoofing), dmarc_not_pass means something authenticated but not for this domain (a Return-Path or selector fix), relay_broke_dkim means probably the customer's own mail modified by a relay, known_by_no_custom_rp / rp_owned_esp_spf_unauthorized name the exact SPF setting to change. Empty on rows parsed before the classifier started recording it.
The "comment" field comes from the DMARC XML report and is populated when ARC (Authenticated Received Chain) overrides the DMARC policy — e.g. when a forwarded message would fail DMARC but ARC trusts the forwarding chain, applying a different effective policy than the p= tag in the DMARC record. Empty when no override occurred.
Optional filters: source_ip, isp, ip_domain_name, eval_spf, eval_dkim, eval_dmarc, source_type, disposition, dkim_domain, dkim_selector, spf_domain. For ISP grouping set problems_only=true to see only rows with authentication failures.
Use this to investigate specific sending sources, drill down into authentication failures, or analyze traffic by provider/IP/reporter.