Spotting Legitimate Bulk Senders vs Spoofers in DMARC Reports

For Australian marketers, IT managers and small business owners running campaigns through Mailchimp, Klaviyo, SendGrid or a local ESP, the daily DMARC aggregate report can feel like alphabet soup. Each XML file lists hundreds of IPs claiming to send on behalf of your domain, and the gap between a genuine vendor and a phishing operation using your brand is often a single misaligned DKIM signature. Knowing how to read the report is what separates a clean reputation from a domain that ends up on a blocklist.

The stakes are especially real under Australian law. The Spam Act 2003 and the Notifiable Data Breaches scheme under the Privacy Act 1988 mean that a spoofed campaign impersonating a Sydney retailer or a Melbourne clinic can trigger legal exposure long before the inbox provider notices. With ACMA actively prosecuting unsolicited email offences, treating DMARC as a forensic tool rather than a checkbox is now table stakes for any brand operating a .com.au or .id.au.

What DMARC Aggregate Reports Actually Contain

Every day, participating receivers (Gmail, Outlook, Yahoo, iCloud, and AU-based providers such as Bigpond and Optus) send a digested XML back to the rua address declared in your DNS. That report carries the source IP, the count of messages, the disposition (none, quarantine or reject), the aligned identifier (SPF or DKIM) that passed, and the header from domain the receiver saw. Tools like Trusted Sender Score parse these files so that a Brisbane operations lead does not have to write their own XML parser.

Two report types exist: aggregate (rua) and forensic (ruf). Aggregate reports are heavily sampled and safe to publish widely. Forensic reports contain near-full message copies intended for abuse handling. Most Australian teams start with rua, then optionally turn on ruf once SPF and DKIM are aligned and a quarantine policy is in place.

Recognising Patterns of Legitimate Bulk Senders

Authentic ESPs publish their sending ranges, often through dedicated subdomains. Klaviyo, Mailgun and SendGrid keep SPF records under their own hostnames and instruct customers to set up a DKIM selector rather than signing from the brand domain. When DMARC shows alignment through the ESP's DKIM signature on a third-party IP, that traffic is almost always sanctioned.

Volume also behaves predictably. A real campaign from a Perth e-commerce store usually hits at a known hour, ramps up over an hour or two, then drops. The IP space repeats across days, and the SPF and DKIM results almost always agree. Headers such as List-Unsubscribe, List-Unsubscribe-Post and a valid feedback-id help confirm the message came from a platform wired into industry norms.

Red Flags That Hint at Spoofing

Spoofers rarely have access to your DKIM private key, so DMARC alignment almost always fails on the DKIM check and only occasionally passes SPF. Look for large bursts from residential ranges, cloud VPS networks in unrelated ASNs, or IPs geolocating outside Australia when your customers are local. Phishing kits targeting AU brands frequently originate from bulletproof hosting in Eastern Europe or Southeast Asia.

Another strong signal is a forged header From that does not match the visible sender domain. A report showing a pass on SPF but a fail on DKIM, especially with a high policy disposition of none, is a classic tell. So are volume spikes that have no corresponding campaign in your ESP dashboard. If you wake up in Adelaide to fifteen thousand alignment failures from a host you have never authorised, treat that as an active incident.

Forensic Steps for Australian Admins

Start by exporting the last 30 days of reports into a single CSV, then pull out every IP with a count above your normal baseline. Cross-reference each IP against your ESP's published ranges, against AbuseIPDB, and against the local CERT. The ACSC's Australian Cyber Security Centre publishes guidance on reporting impersonation scams, and many ISPs accept abuse reports via the addresses listed in WHOIS.

For domains that already appear on blocklists, the recovery workflow matters as much as the diagnosis. Teams in Sydney and Melbourne typically follow a documented cleanup runbook covering blacklist removal so that marketing sends can resume without bouncing. Pair that with a quarantine DMARC policy enforced for at least a week before moving to reject.

Automating Checks Across the Stack

Manually reviewing XML feeds is fine for one domain but quickly falls apart across a portfolio of local brands. The platform exposes a REST endpoint that returns parsed trust scores, alignment counts and policy recommendations in JSON, which slots cleanly into a SIEM rule or a Slack alert. Security teams in Brisbane and Canberra have wired it into their SOAR playbooks so that an unaligned DKIM spike pages the on-call analyst within minutes.

Pulling parsed results directly into Splunk, Sentinel or Elastic closes the loop between detection and remediation. The SIEM integration tips walk through connecting the endpoint, mapping fields, and triggering alerts when a campaign's IP space drifts from last quarter's baseline. That correlation is often the difference between catching a hostile campaign early and discovering it after customers have reported scams to Scamwatch.

Comparing a Real Vendor Against a Spoof

Signal	Legitimate Bulk Provider	Spoofed Traffic
DKIM alignment	Pass via ESP selector	Fail or absent
SPF alignment	Pass via ESP include	Fail on most attempts
IP reputation	Listed in ESP documentation, often cloud-hosted	Residential, VPS, bulletproof hosting
Volume pattern	Predictable, ramped, repeating daily	Sudden spikes, off-hours, no campaign record
Header artefacts	List-Unsubscribe, feedback-id, ESP headers	Stripped, mismatched, missing
Geographic origin	Operating regions of vendor	Often unrelated to brand audience
DMARC disposition with policy in place	None to quarantine	Heavy quarantine or reject when enforced

Reading the report with those signals in mind gives any Australian operator a faster path from raw XML to a defensible verdict, without needing a dedicated threat intelligence team.