Every verdict shows its working.
The Risk Analysis page is the full-screen report behind a score. It lists each check by name with its result and status, explains the verdict in plain language, shows the counterparty's history with your organization, and offers the administrative actions that resolve the case.
Provider type, similarity, trust list, prior communication, MX, domain age, SPF, DMARC and reputation — each with its own status.
A summary statement that says why this address is risky, not just how much.
Trust the domain, verify the client or blacklist the address without leaving the report.
Checks are grouped into stages that follow the order a human analyst would work in — identity first, then your own history, then infrastructure, then authentication, and finally the decision.
A check that could not be resolved reports unknown, never pass. Privacy-protected registration data, a throttled lookup or a missing record are all distinct from a clean result, and the report keeps them distinct so nobody reads a gap as an all-clear.
The bottom of the report is a chronological log: who ran checks against this address, which manual overrides were performed and on what justification, and who authorized each dispatch. It is the record an investigation or an auditor will ask for.
Reach the report from a scan, a protected send or the threat overview.
Work down the stages; each row carries a result and a status.
Trust, verify or blacklist directly from the report.
Every action is timestamped and attributed in the audit trail.
The outcome
Analysts stop arguing about scores and start reading evidence, which is what makes a verdict defensible.
Set up your organization in minutes — no inbound migration required.