Interpret sources and alignment
Group report data by sending source, volume, SPF and DKIM results, and domain alignment. Compare each source with your inventory of approved applications and vendors before deciding that an unfamiliar sender is malicious.
A message can pass SPF or DKIM but still fail DMARC alignment, depending on the visible From domain and authenticated identifiers. Review the alignment details rather than treating one pass result as sufficient.
Make policy changes carefully
Use reports over a representative period because volumes and sources can vary by day or campaign. Investigate unknown sources with their owners before changing policy, since tightening too quickly can reject legitimate mail.
Aggregate reports do not usually contain every message body, but can still reveal domain usage and recipient infrastructure. Restrict access, set a retention period, and avoid publishing reports that expose operational details.