From 2ebe26681e70d72fdabd91cf69834ad21cd0e07f Mon Sep 17 00:00:00 2001 From: Sean Whalen <44679+seanthegeek@users.noreply.github.com> Date: Tue, 21 Jul 2026 22:20:41 -0400 Subject: [PATCH] Document per-signature row semantics in the alignment tables A message carrying multiple DKIM signatures appears once per signature in the details tables, so summing the messages column across rows can exceed the total message count. State that explicitly rather than leaving readers to infer it. Co-Authored-By: Claude Fable 5 --- docs/source/kibana.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/source/kibana.md b/docs/source/kibana.md index 16b27b83..e6fa9702 100644 --- a/docs/source/kibana.md +++ b/docs/source/kibana.md @@ -86,7 +86,9 @@ table. Each row of the DKIM details table is one real DKIM signature, shown as a combined `selector / domain / result` value; the SPF details table shows `scope / domain / result` the same way. Combining the values into one column keeps each signature's selector, domain, and result paired together, -rather than aggregating them as separate columns. +rather than aggregating them as separate columns. Because a message that +carries multiple DKIM signatures appears once per signature, summing the +messages column across rows can exceed the total number of messages. :::{note} The alignment tables (SPF details, DKIM details) and the per-IP source