Tracking monthly trust score trends across key business partners

A monthly trust report gives security and procurement teams a consistent view of how their most important partners handle email identity. Rather than treating a single score as a pass-or-fail result, the report should show movement over time, explain the reasons behind each change, and identify partners that may create phishing or spoofing exposure.

For Australian organisations, this process is especially useful when suppliers, franchises and service providers operate across Sydney, Melbourne, Brisbane and regional locations. A clear record helps teams distinguish a temporary configuration issue from a pattern that needs escalation, while supporting practical checks under the Privacy Act 1988 and the Australian Privacy Principles.

Define the partner set and reporting rules

Start by creating a fixed list of 50 business partners. Use a consistent selection method, such as annual spend, access to sensitive data, customer-facing activity or the volume of email exchanged. Record each organisation’s legal name, primary domain, subsidiaries, known sending domains and business owner so that a domain change does not appear as a sudden trust decline.

Set a reporting date, collection window and scoring standard. For example, capture results on the first business day of every month and compare them with the previous three, six and twelve months. Keep the same domains in the main group whenever possible, while documenting replacements separately. This makes the trend line meaningful and prevents a newly added low-risk supplier from distorting the overall result.

Collect authentication and reputation data

For every partner, record the current trust score alongside DKIM, SPF and DMARC status. Note whether DMARC is set to monitoring, quarantine or reject, and capture any visible misalignment, expired records, invalid selectors or unauthorised sending services. A partner with a good reputation but weak authentication deserves attention because its position may change quickly after a compromised mailbox or new marketing platform is introduced.

Use a repeatable source for each monthly check, such as Trusted Sender Score, and retain the date, domain and result in a central worksheet or security platform. Bulk checking can reduce manual work for a portfolio of 50 domains, while an API can feed results into a risk register or supplier-management workflow. Store only the information needed for assurance purposes and restrict access where domain data is linked to identifiable staff or customers.

Build a useful trend view

A practical report should contain a summary dashboard, a partner-level detail table and a short list of priority changes. Useful fields include current score, previous score, monthly variance, three-month direction, authentication status, risk rating and assigned owner. Use simple labels such as improving, stable, declining and critical rather than relying on colour alone, which supports readers with different accessibility needs.

Calculate the portfolio average, median score and number of partners with declining results. The median is valuable because one exceptionally poor domain can pull down an average and hide the condition of the wider group. Include the largest increases and decreases, but explain whether they resulted from genuine remediation, a domain migration, a new sender or a change in the checking method.

Investigate meaningful changes

Set thresholds that trigger review, such as a drop of ten points, a move from reject to monitoring, or the appearance of a new unauthorised sender. Check whether the change relates to DNS updates, a bulk-mail campaign, a vendor transition or an incident reported by the partner. A sudden deterioration in a supplier that sends invoices or password notices should receive greater priority than a minor variation from a low-volume provider.

The anti-spoofing guidance can help teams interpret impersonation risks and decide which controls to discuss with a partner. Contact the relevant account manager with specific evidence, including the affected domain, date observed and authentication result. Avoid sending sensitive message content in ordinary email; use an approved channel when an investigation involves customer records, credentials or possible compromise.

Present actions for Australian stakeholders

Write the executive summary in operational terms: how many partners improved, how many declined, which critical relationships need attention and what action is due next month. Link each high-risk item to an owner and deadline, such as requesting a DMARC enforcement plan, confirming approved sending services or validating a supplier’s incident contact. A short commentary is more useful than a page of unexplained technical results.

Consider local operating conditions when interpreting the data. Australian businesses often rely on cloud payroll, accounting and logistics providers that send from shared platforms, and public holidays such as Australia Day or the Easter period can alter message volumes. A partner serving customers in Perth may use different support and infrastructure schedules from a Melbourne office, so record the business context before escalating an anomaly. Keep reports aligned with internal retention policies and Australian privacy obligations, and archive each monthly snapshot so auditors can trace what was known, when it was known and how the organisation responded.