Threats
Listed means the sending IP is on a threat blocklist (not a soft risk score). DNS configuration findings are separate below.
—
Listed messages
Msgs from blocklisted IPs
—
Distinct listed IPs
Source IPs on threat feeds
—
Listed still delivered
Disposition none despite listing
—
Unauth delivered
Disposition none without auth
—
Blocked
Quarantine + reject
Insights
What changed in this window for blocklist-listed source IPs.
Risk matrix
Authentication outcome × blocklist-listed source IPs (threat_listed, not a soft score).
Listed source IPs
Click an IP for geo, RDAP, and feed flags.
Threat feeds
Volume and distinct IPs by list.
Domains with listed mail
Share of window volume that came from listed IPs.
Open Findings
Open DNS/configuration findings by severity.
Top blockers
Open critical / high / warning findings across the organisation (by title).
TLS failure types
From TLS-RPT failure-details in this window.
Forensic (RUF) failures
Auth-failure types from forensic reports.
ARC in aggregate mail
ARC result on aggregate report rows when present (mail path, not DNS readiness).
Forensic samples
RUF metadata only — no message body or recipients.