[dmarc-discuss] Discrepancies between ISPs' aggregate reports

Dave Hensley dave at thinkmail.com
Tue Jun 12 12:25:37 PDT 2012

Like many of you, I recently began receiving aggregate reports from
Yahoo, after receiving reports from Google for many months. I'm also
starting to receive reports from smaller ISPs, e.g. 126.com,
xs4all.nl, etc. It's wonderful that these early adopters are already
sending reports, but the subtle differences are tripping up the script
that I use to process them.

For example, according to http://www.dmarc.org/faq.html (if you click
on "I need to implement aggregate reports, what do they look like?"),
the reports should contain the following:


Google's reports replace "identifiers" with "identities" (typo?).

Also, Yahoo's XML stream seems to be generated line-by-line, because
there are some weird whitespace issues:

  <end>1339459199 </end>

Note the extra space before the closing "end" tag. There is also
arbitrary whitespace at the end of each line. It was easy to fix my
script to trim all values, but this should probably still be fixed.

Finally, it seems that Google and Yahoo agree about the date range of
the reports (12:00:00am to 11:59:59pm UTC). But I've received reports
from 126.com that go from 4:00:00pm UTC to 3:59:59pm UTC, and the
report that I received today from xs4all.nl goes from 12:58:12pm UTC
to 1:00:04pm UTC the following day, which isn't even a 24-hour period.
Sadly, this makes it impossible to combine the reports together (to
aggregate the aggregate reports, as it were).

I hope that this message doesn't come off as peevish or denunciatory;
I think it's great that the system is working at this early stage and
that I'm already receiving these reports, and I certainly appreciate
all of the hard work that everyone has contributed. I just believe
that a few quick bug fixes would make the reports much more usable for


More information about the dmarc-discuss mailing list