[dmarc-discuss] Discrepancies between ISPs' aggregate reports

Michael Adkins madkins at fb.com
Tue Jun 12 13:01:02 PDT 2012

These are good things to look at during the interop event.

On 6/12/12 12:25 PM, "Dave Hensley" <dave at thinkmail.com> wrote:

>Like many of you, I recently began receiving aggregate reports from
>Yahoo, after receiving reports from Google for many months. I'm also
>starting to receive reports from smaller ISPs, e.g. 126.com,
>xs4all.nl, etc. It's wonderful that these early adopters are already
>sending reports, but the subtle differences are tripping up the script
>that I use to process them.
>For example, according to http://www.dmarc.org/faq.html (if you click
>on "I need to implement aggregate reports, what do they look like?"),
>the reports should contain the following:
>  <header_from>example.com</header_from>
>Google's reports replace "identifiers" with "identities" (typo?).
>Also, Yahoo's XML stream seems to be generated line-by-line, because
>there are some weird whitespace issues:
>  <begin>1339372800</begin>
>  <end>1339459199 </end>
>Note the extra space before the closing "end" tag. There is also
>arbitrary whitespace at the end of each line. It was easy to fix my
>script to trim all values, but this should probably still be fixed.
>Finally, it seems that Google and Yahoo agree about the date range of
>the reports (12:00:00am to 11:59:59pm UTC). But I've received reports
>from 126.com that go from 4:00:00pm UTC to 3:59:59pm UTC, and the
>report that I received today from xs4all.nl goes from 12:58:12pm UTC
>to 1:00:04pm UTC the following day, which isn't even a 24-hour period.
>Sadly, this makes it impossible to combine the reports together (to
>aggregate the aggregate reports, as it were).
>I hope that this message doesn't come off as peevish or denunciatory;
>I think it's great that the system is working at this early stage and
>that I'm already receiving these reports, and I certainly appreciate
>all of the hard work that everyone has contributed. I just believe
>that a few quick bug fixes would make the reports much more usable for
>dmarc-discuss mailing list
>dmarc-discuss at dmarc.org
>NOTE: Participating in this list means you agree to the DMARC Note Well
>terms (http://www.dmarc.org/note_well.html)

More information about the dmarc-discuss mailing list