Netcraft recognized Microsoft 365 and Google Workspace quickly because the mail streams had stable DKIM domains and predictable source IPs. SendGrid and Mailchimp were present in the report drilldowns, but we had to add owner notes to separate approved marketing traffic from the unknown sender. The SPF pass with visible-from mismatch was visible as an authentication discrepancy, yet the product treated it more like evidence for review than a prescriptive DMARC fix.

The comparison run grouped the same approved senders into clearer ownership queues and made the unknown sender a classification task. It also separated the DKIM pass on a subdomain from true spoofing, which made the policy conversation easier for the marketing subdomain and parked domain.

Netcraft asked for DNS records and domain setup in a sequence that made sense for the corporate domain, but the marketing subdomain and parked domain needed extra context in our handoff notes. The unknown sender was visible in the reports, though we had to compare DKIM domains, source IPs, and known vendor traffic before deciding it was not approved.

The comparison workflow completed the same three-domain setup with fewer notes. The forwarded mail SPF failure was explained as forwarding behavior instead of a sender breakage, so the support desk owner did not get a false remediation task.

During setup, the handoff was easiest when we framed the three test domains as part of a fraud monitoring scope rather than a simple DMARC project. DNS work still sat with our operator, and the useful escalation path was around confirming suspicious activity, report access, and what should move into countermeasure review.

For the comparison workflow, we evaluated support by how quickly a non-specialist moved a Microsoft 365 or Google Workspace finding to a DNS owner. The practical gap was less about response time and more about whether support material translated aggregate reports into exact policy and sender steps.

Netcraft separated the corporate domain, marketing subdomain, and parked domain cleanly enough for enterprise review. Recurring reporting worked for a central security team, but MSP-style client handoff felt manual because owner notes, sender approvals, and next actions were not packaged for repeated client review.

The comparison run was easier to map to SMB and MSP operations because the same Microsoft 365, Google Workspace, SendGrid, Mailchimp, and support desk findings were grouped around ownership. It was less about fraud escalation and more about who approves each sender, who edits DNS, and when the domain can move policy.