[dmarc-discuss] Discrepancies between ISPs' aggregate reports

Pradeep Kyasanur kyasanur at googlers.com
Tue Jun 12 14:07:22 PDT 2012


On Tue, Jun 12, 2012 at 12:25 PM, Dave Hensley <dave at thinkmail.com> wrote:

> Like many of you, I recently began receiving aggregate reports from
> Yahoo, after receiving reports from Google for many months. I'm also
> starting to receive reports from smaller ISPs, e.g. 126.com,
> xs4all.nl, etc. It's wonderful that these early adopters are already
> sending reports, but the subtle differences are tripping up the script
> that I use to process them.
>
> For example, according to http://www.dmarc.org/faq.html (if you click
> on "I need to implement aggregate reports, what do they look like?"),
> the reports should contain the following:
>
> <identifiers>
>  <header_from>example.com</header_from>
> </identifiers>
>
> Google's reports replace "identifiers" with "identities" (typo?).
>
Thanks Dave, we will fix this (we had an early implementation that has a
few inconsistencies with current spec that we will fix by interop event in
mid July).


>
> Also, Yahoo's XML stream seems to be generated line-by-line, because
> there are some weird whitespace issues:
>
> <date_range>
>  <begin>1339372800</begin>
>  <end>1339459199 </end>
> </date_range>
>
> Note the extra space before the closing "end" tag. There is also
> arbitrary whitespace at the end of each line. It was easy to fix my
> script to trim all values, but this should probably still be fixed.
>
> Finally, it seems that Google and Yahoo agree about the date range of
> the reports (12:00:00am to 11:59:59pm UTC). But I've received reports
> from 126.com that go from 4:00:00pm UTC to 3:59:59pm UTC, and the
> report that I received today from xs4all.nl goes from 12:58:12pm UTC
> to 1:00:04pm UTC the following day, which isn't even a 24-hour period.
> Sadly, this makes it impossible to combine the reports together (to
> aggregate the aggregate reports, as it were).
>
> I hope that this message doesn't come off as peevish or denunciatory;
> I think it's great that the system is working at this early stage and
> that I'm already receiving these reports, and I certainly appreciate
> all of the hard work that everyone has contributed. I just believe
> that a few quick bug fixes would make the reports much more usable for
> everyone.
>
> Best,
> Dave.
> _______________________________________________
> dmarc-discuss mailing list
> dmarc-discuss at dmarc.org
> http://www.dmarc.org/mailman/listinfo/dmarc-discuss
> NOTE: Participating in this list means you agree to the DMARC Note Well
> terms (http://www.dmarc.org/note_well.html)
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://medusa.blackops.org/pipermail/dmarc-discuss/attachments/20120612/cff686ce/attachment-0001.htm>


More information about the dmarc-discuss mailing list