Which email security metrics should admins track each month?

Most admins only look at email security reports after something goes wrong. A short monthly review catches problems earlier: a filter that's quietly started holding invoices, a new service failing DMARC, or users who've stopped reporting phishing. This guide covers six metrics worth tracking, where to find each one in Microsoft 365 and Google Workspace, and a template you can copy.

Which email security metrics matter most?

Pick a few numbers you can collect the same way every month. These six cover the filter, your users and your domain.

Avoid vanity numbers. "We blocked 40,000 messages" sounds good but doesn't tell you whether anything important got through or got lost.

Where do you find these metrics in Microsoft 365?

Most of the data lives in the Microsoft Defender portal at Reports > Email & collaboration > Email & collaboration reports (Microsoft Learn). The reports below are available without Defender for Office 365 unless noted.

Spam, phishing and malware caught

Use the Threat protection status report. Microsoft says it's "available in all organizations with cloud mailboxes", with more data if you have Defender for Office 365. Its Email > Phish, Spam and Malware views break detections down by technology. The Mailflow status report shows the bigger picture, including mail blocked at the edge, and Microsoft calls it "the only report that contains edge protection information". Microsoft counts each recipient separately, so one message to five people counts as five.

Quarantine releases

There's no single release report. Two options:

1. In the Defender portal, open Email & collaboration > Review > Quarantine and filter by Release status.
2. In Exchange Online PowerShell, run Get-QuarantineMessage -ReleaseStatus Released. Microsoft says the cmdlet returns the last 16 days by default and no more than 30 days of data, so run it monthly and save the output (Microsoft Learn).

Release counts are a proxy. Our guide to false positives explains how to find the cause behind each one.

User-reported phishing and verdicts

The User reported messages report shows what users marked as junk, phishing or not junk with the built-in Report button. The details sit on the User reported tab of the Submissions page. After you review a report, the Mark as and notify action gives it a verdict of No threats found, Phishing or Spam and tells the user (Microsoft Learn). Count reports by verdict. If the button isn't set up, start with our guide to user reported settings in Microsoft 365.

Inbound authentication failures

The Spoof detections report shows messages blocked or allowed because of spoofing, with 90 days of filtering.

Exports and schedules

Microsoft lets you schedule recurring reports weekly, daily or monthly from the report page, and export the details table. A monthly schedule for Threat protection status and Mailflow status saves you from collecting them by hand.

Where do you find them in Google Workspace?

Google's main source is the security dashboard, at Menu > Security > Security center > Dashboard in the Admin console (Google Workspace Admin Help). Check your edition first. At the time of writing (October 2026), Google lists the dashboard for Frontline Standard and Plus, Enterprise Standard and Plus, Education Standard and Plus, and Enterprise Essentials Plus, and the email charts below aren't available on Frontline Standard or Enterprise Standard. Business editions aren't on the list.

Where the dashboard is available:

• Spam filter - All, Spam filter - Phishing and Spam filter - Malware show where flagged mail went and malware found before or after delivery.
• User reports shows how users label their mail: not spam, spam or phishing.
• Authentication splits inbound and outbound mail into authenticated and unauthenticated.
• Spoofing shows messages with signs of spoofing.

Google says these email reports keep data for the last 30 days, so record the numbers before they roll off.

On Business editions, use Email Log Search to trace individual messages, including ones sent to spam or admin quarantine, and review the admin quarantine itself for releases. Google says recipients are never notified about admin quarantine, so the release count there reflects admin decisions, not user requests. Our Gmail spam settings guide covers how that quarantine is set up.

How do you measure DMARC pass rate and authentication failures?

Your DMARC pass rate comes from aggregate reports, not from your mailbox platform. Receivers send daily XML reports to the rua address in your DMARC record, as defined in RFC 9990. Each row lists a sending IP, a message count and whether SPF and DKIM passed and aligned.

To turn those into a monthly number:

1. Collect a month of aggregate reports. If you don't receive any, check your record with the DMARC Checker.
2. Load them into the DMARC Report Analyzer, which runs in your browser.
3. Group rows by source: your own services, forwarders, and unknown senders.
4. Calculate the pass rate for your own services only. That's the number you want close to all of it.
5. Note the volume from unknown sources that failed. That's spoofing, and an enforced policy is what stops it.

Our guide to reading DMARC reports explains each field, and unknown sources in DMARC reports helps you sort the sources you don't recognize. Inbound authentication failures, meaning mail claiming to be from someone else, come from the Spoof detections report on Microsoft 365 or the Authentication and Spoofing charts on Google's dashboard.

How do you measure time to remediate?

Time to remediate is the gap between the first sign of a threat and its removal from every mailbox. Neither platform reports it directly for small tenants, so measure it yourself:

1. Start when the first user reports the message or an alert fires.
2. Confirm when an admin gives a verdict.
3. Finish when every copy is removed or confirmed handled, for example by searching message trace or Email Log Search for the same sender and subject.

Write down the three timestamps for each confirmed phishing incident in a shared sheet. Over a few months you'll see whether the slow step is noticing, deciding or cleaning up. Microsoft's zero-hour auto purge removes some threats after delivery automatically, so check whether ZAP acted before you count a message as yours to clean up.

How do you read the trends?

One month of numbers tells you little. Three to six months tell you a lot. Look for these patterns:

• Caught mail drops sharply while users report more phishing. Mail may be reaching your platform by a route that skips filtering, such as an old MX host or direct delivery to the platform.
• Releases climb after a policy change. The new setting is too strict. Roll it back or narrow it.
• The same sender is released every month. Find out why it fails, usually authentication, and fix it at the source rather than allowlisting it.
• User reports fall to zero. Either the Report button broke or people stopped bothering. Check the button, then remind staff.
• A new source appears in DMARC reports. Someone signed up for a service that sends as your domain. Authenticate it or shut it down.

What should a monthly report look like?

Keep it to one table and a few lines of notes. Use the same definitions every month.

End the report with three lines: what changed, what you fixed and what you'll check next month.

Next steps

• Set a recurring monthly reminder and copy the template above into a shared sheet.
• On Microsoft 365, schedule the Threat protection status and Mailflow status reports to arrive monthly.
• On Google Workspace, confirm whether your edition has the security dashboard before planning around it.
• Point your DMARC rua address at a mailbox you read, and run the first month through the DMARC Report Analyzer.
• If you filter mail before it reaches your platform, include that layer's numbers too. iBlockSpam keeps 30 days of message history per domain, and Protect Plus adds a monthly owner report.