Examine direct traffic patterns

I need a clear read on direct sessions for the last 90 days compared to the previous 90. Pull the daily direct traffic numbers, show percentage change, and highlight any three-day spikes. Verify whether those spikes align with campaign sends, site maintenance, or DNS changes before I act on them.

Before I show this to the marketing director, make direct traffic easy to interpret: surface the total direct sessions and percent change at the top, label any sustained increases longer than three days, and flag dates that match email sends, paid social bursts, or site changes that could explain phantom direct counts.

Yesterday and April 12 both have big direct spikes. I own growth but fear these are measurement artifacts from missing UTM tags or a CDN cache clear. I cannot tell whether an email without UTM or a bot attack caused this. What is the most likely cause and what should I check first to diagnose and fix it?

Over several months I keep getting brief surges in direct sessions that later vanish when I fix tracking. Where am I most likely breaking this measurement — email teams not tagging links, server redirects stripping query strings, or third-party widgets — and what one habit change will reduce these false direct spikes?