Who is sending mail as your domain
An inventory of every system sending as you, built from DMARC reports — including the ones nobody signed off on.
Included with Smoo AI Support - Pro, Smoo Workforce + Support Bundle and 5 more plansSee plans
Every IP in a DMARC report is something sending mail claiming to be your domain. Grouped and named, that list is an inventory of your real mail-sending footprint: your mail provider, your marketing tool, your helpdesk, your invoicing system — and anything a team signed up for without telling anyone.
Smoo identifies each sender from its DKIM signature first, because that is cryptographic proof of who signed the message. Where there is no signature to read, it falls back to the SPF domain and then to reverse DNS, which are weaker hints. A sender it cannot identify is left as "Unidentified" rather than guessed at — those are the ones worth your time.
How to
- 1
Open Sending Sources and read the Unidentified count first.
Every unidentified sender is either a tool someone adopted without telling IT, or something spoofing you. Both are worth knowing about before you tighten policy.
- 2
Work down the list by volume and account for each sender.
Anything you recognise and want to keep should be authenticated — configure it to sign with your domain, or authorise it in SPF.
- 3
Check the New badge after adding or removing a vendor.
New means first seen in the last 14 days, measured against all the history we hold rather than the window you are viewing.
- 4
Only tighten your DMARC policy once nothing legitimate is failing.
Moving to p=quarantine or p=reject while a real sender still fails will send your own mail to spam.
If something goes wrong
- A source is marked "Likely forwarder" and fails SPF.
- That is expected and needs no fix. A mailing list or alias re-sending your mail breaks SPF by design but keeps the DKIM signature intact, so the message still passes DMARC. It is counted as authenticated, not as a failure.
- A sender shows as Unidentified but we know what it is.
- It means nothing authenticated it — no DKIM signature we could read, no recognisable SPF domain, no useful reverse DNS. That is itself the finding: configure that vendor to sign with your domain so it authenticates and identifies itself at once.
- A tool we use does not appear in the list at all.
- We can only see senders that appear in DMARC reports. A system sending very little mail may never generate one, so absence from this list is not proof it is not sending.