Sending identities
An identity is a named sender — one or more IPs/CIDRs grouped under a vendor name — marked as a legitimate sender, a forwarder (SPF breakage expected, DKIM should survive), or known malicious (any further volume raises an urgent alert). Identities drive the classification badges on every sources table and the verdicts on source pages.
Add identity
Suggestions
Sources from the last 30 days not covered by any identity, grouped automatically by their network (from enrichment, falling back to reverse DNS). The suggested kind comes from the alignment pattern — mostly aligned reads legitimate, DKIM-pass-with-SPF-fail reads forwarder, fully unaligned suggests malicious — but nothing is trusted until you accept it, and you can change the kind before accepting.