Subject: [dmarc-ietf] Confused about DMARC Reports (ruf/rua)

From: Tim Smith <[email-masked]>
Date: Mon, 8 Jun 2015 13:13:27 +0100

I have a DMARC record that looks like :

_dmarc  IN      TXT
"v=DMARC1\;p=none\;rua=mailto:[email-masked]\;ruf=mailto:[email-masked]\;fo=1:d:s\;adkim=r\;aspf=r\;pct=100\;rf=afrf\;ri=86400\;sp=reject"

But I am still receiving reports from hotmail despite DKIM and SPF
tests passing ?  So I don't understand what hotmail's system's are
moaning about ?!?

<?xml version="1.0"
encoding="utf-8"?><feedback><report_metadata><org_name>Microsoft
Corp.</org_name><email>[email-masked]</email><report_id>[email-masked]</report_id><date_range><begin>1433491200</begin><end>1433577600</end></date_range></report_metadata>
<policy_published>
<domain>example.org</domain>
<adkim>r</adkim>
<aspf>r</aspf>
<p>none</p>
<sp>reject</sp>
<pct>100</pct>
</policy_published>
<record>
<row>
<source_ip>10.3.4.5</source_ip>
<count>1</count>
<policy_evaluated>
<disposition>none</disposition>
<dkim>pass</dkim>
<spf>pass</spf>
</policy_evaluated>
</row>
<identifiers>
<header_from>example.org</header_from>
</identifiers>
<auth_results>
<spf><domain>example.org</domain>
<result>pass</result>
</spf>
<dkim>
<domain>example.org</domain>
<result>pass</result>
</dkim>
</auth_results>
</record>
</feedback>

---

From: Hector Santos <[email-masked]>
Date: Mon, 08 Jun 2015 11:47:38 -0400

I can hardly read these inconsistent formatted reports.  Can we turn 
it off?

On 6/8/2015 8:13 AM, Tim Smith wrote:
> _______________________________________________
> dmarc mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dmarc
>
>

-- 
HLS

---

From: "John Levine" <[email-masked]>
Date: 8 Jun 2015 15:55:39 -0000

>tests passing ?  So I don't understand what hotmail's system's are

Aggregate reports aren't failure reports, they're aggregate reports.
They tell you about all incoming mail that purports to be from you
and what the recipient thought about it.

R's,
John

---

From: Franck Martin <[email-masked]>
Date: Mon, 8 Jun 2015 10:56:19 -0500 (CDT)

----- Original Message -----
> From: "Tim Smith" <[email-masked]>
> To: [email-masked]
> Sent: Monday, June 8, 2015 5:13:27 AM
> Subject: [dmarc-ietf] Confused about DMARC Reports (ruf/rua)
> 

You are getting an aggregate report.

Any receiver will send you an aggregate report as long as they got at least one email with your Domain in the From: header. (in general)

The aggregate report is to tell you how many emails from your domains the receiver has seen, and which emails passed DMARC and which ones did not and why (in an aggregated fashion)...