What this screen is for
The Dashboard answers three questions without you clicking anything: can mail be forged as me right now, what has changed recently, and what should I do next. It is the first thing the panel shows after you sign in.
It is a reading, not a report you have to assemble. Every figure on it arrives from a call made while you were looking at it - see the last section, which is the most important one on this page.
What each tile shows
- Can mail be forged as you right now?
- Runs the checks live against public DNS for a domain you name, and answers from the DMARC policy that came back. How many checks ran is shown with the result, because it comes from the run rather than from this page. Reject means receivers are told to refuse forgeries; quarantine means a forgery still reaches the spam folder, where it can still be read; none, or no DMARC at all, means a forgery is delivered normally. The explanation under the headline is the check service's own wording, not a summary of it.
- Domains under monitoring
- How many domains this organisation is watching. Today this usually says it cannot be read - see the last section.
- What changed recently
- A timeline built only from timestamps the API returned: when the account and the organisation were created, when a token was created, last used or revoked, and any check run in this browser session. Nothing on it is dated by the page.
- What to do next
- Each item is here because of something a response actually said, and each names the call and the field that put it there - so you can tell a reading apart from advice.
- Your account and plan
- Your account record and your organisation record, as returned. What the plan permits, with the domain meter, is on Organisation instead.
What to do next
- Check the domain you actually send mail from. The field is filled with a suggestion taken either from your monitored domains or from the domain of your sign-in address, and the line under it says which - change it if neither is right.
- Read the headline before the score. A high score with a DMARC policy of "none" still means anybody can send as you; the score counts hardening too, and hardening is not what stops a forgery. No example figure is printed on this page, because a number in help is a number somebody reads as their own.
- Work the "What to do next" list from the top. It is ordered failures first, and within failures by how much the check weighs - the same weights the check service publishes.
- Re-run the check after each DNS change. DNS caches, so leave a few minutes.
Why a tile is sometimes blank, and what that means
A blank tile on this screen is a deliberate statement, not a loading failure. When a tile cannot get its data it prints the API's own message, the action the API suggests, and the reference id for that call - and it shows no figure at all.
None and unknown are different things, and this screen never confuses them. "No domains are monitored yet" is printed only when the API answered with a list and that list was empty. If the call was refused, or answered with something that is not the list it documents, or was never made at all, the tile says that instead - because telling you that you have nothing, when nobody established it, is a claim about your account that looks like reassurance.
- Refused
- The API answered with an error. You get its own wording, what it suggests you do, and the reference id to quote to us.
- Not readable
- The API answered successfully but with a body that is not the shape that route documents. No count is shown, because any count taken from it would be a guess.
- Not asked
- No call was made, and the tile says what stopped it - for example, tokens belong to an organisation, so with no organisation attached there was nothing to ask about.
- Empty
- The API answered, and the answer was none. This is the only one of the four that is a fact about your account.
The same four answers apply to your organisation, and for the same reason. "This account is not a member of an organisation" is printed only when we asked and were told so. If the lookup failed, the screen says the organisation could not be read - and anything that hangs off it, your API tokens included, says it does not know rather than reporting an absence it inherited from a question nobody answered.
The reason is the same one that shapes the whole panel: an interactive sign-in is not scoped to a single organisation, because one person can hold seats in several. Routes that need a single organisation named - your domain list and your check history - refuse a session rather than guess. That is why the domains tile usually says it cannot read a count, and why the timeline says a full activity feed is not available to it.
A tile will never show a number it did not receive
No figure on this screen is a placeholder, a sample or an average. If a call did not answer, the tile says which call and why. A dashboard of plausible numbers is the easiest thing in a product to fake and the most expensive thing to trust wrongly, so this one does not do it.
What this screen does not do
A live reading of DNS, not monitoring
The check reads what your domain publishes publicly at the moment you press the button. It does not send mail, read any mailbox, or change anything.
The result is not kept. Reading a past run back needs the check-history route, which refuses an interactive session, so leaving this screen loses the reading and the tile honestly returns to having nothing to show. Continuous monitoring from DMARC reports is on the roadmap rather than built.