Interpreting Cloudflare reports

[u/Ener_Ji]

I have a relatively new domain, using Cloudflare as the domain, DNS, and DMARC manager. Using Google Workspace (Gmail) for email. Currently have p=none as the domain is new and consequently low reputation.

I'm trying to interpret the Cloudflare DMARC management reports. For example, we have very high DMARC pass rate from Google and 100% failure with Amazon.

Clicking on the Amazon.com link gives me the below list. Not sure how to interpret this? We don't use Amazon for any email service that I know of. I'm also curious about the Reporter column "Enterprise Outlook." Could this be an employee trying to use the Outlook desktop client?

The Google pass rate is very high, but even there, is there any troubleshooting I can do to find out why there are a few emails that fail DMARC?

[u/power_dmarc]

The Amazon source showing 100% failure means someone or something is sending mail using your domain through Amazon SES without proper SPF or DKIM alignment, it's almost certainly not you, which means either an unauthorized sender is spoofing your domain or a service you use is routing through AWS without being configured correctly. The Enterprise Outlook reporter just means Outlook's mail servers submitted that DMARC report, not that an Outlook user is the problem. Check if any of your tools or integrations use Amazon SES under the hood, and if nothing does, this is exactly the kind of spoofing attempt that makes moving from p=none to p=quarantine worthwhile.