How GTM Inboxes uses this term
GTM ingests aggregate reports, aggregates rows per sending source, and flags sources whose volume passes a threshold with zero authentication passes as potential spoofing for operator review.
Reading a report safely
Aggregate reports arrive per receiver and per day, so one report is a sample, not the whole picture. Look at per-source pass rates over time: aligned sources belong in SPF or DKIM, and persistent zero-pass volume deserves investigation.
From reports to policy
Use rua evidence to fix alignment for legitimate senders first, then step policy from none toward quarantine or reject once report data shows clean authentication for the sources you intend to keep.