R6 — Unknown source, sustained spoofing campaign

Triggers when: the R5 condition (unknown source, both SPF and DKIM failing, above threshold) persists across at least the configured minimum number of distinct report days in the longer sustained-analysis window, rather than appearing in a single report.

What to do: the same investigate-don't-block guidance as R5 applies, with added urgency — a sustained pattern across multiple days is stronger evidence of an active, ongoing spoofing campaign rather than a transient misconfiguration somewhere.