deliverlensHandle the attachment as untrusted input
Accept reports only through the approved destination. Bound message and decompressed sizes, reject dangerous archives, disable XML external entities and network access, validate the expected media type and schema, and deduplicate by reporter/report identifier and date range. Preserve the original only as long as policy requires.
RFC 9990 uses the urn:ietf:params:xml:ns:dmarc-2.0 namespace for current reports. During transition you may also receive legacy-form reports; label the format and parse it deliberately instead of silently treating every XML shape as equivalent.
Read from the outside inward
Start with report metadata: reporter, report ID, and UTC date range. Then inspect the policy that the reporter says it observed. A policy change during a reporting window can produce mixed or multiple reports, so compare it with DNS history rather than assuming today’s record applied throughout.
Each record includes a source IP, count, policy evaluation, identifiers, and authentication results. Build a normalized row such as:
| Source | Count | Disposition | DMARC | SPF domain/result/alignment | DKIM domain/result/alignment |
|---|---|---|---|---|---|
192.0.2.40 | 120 | none | pass | bounce.example.com / pass / yes | example.com / pass / yes |
The address is reserved. Keep the reporter’s raw values available for audit.
Map observations to senders
Join source IPs and authenticated domains to provider accounts, application streams, and owners. Use representative message headers and provider logs to confirm the match. Shared providers can make an IP recognizable without proving that all counted messages came from your account.
Prioritize legitimate high-volume failures, new unknown sources, and sudden changes. Separate aligned pass, authenticated-but-unaligned, underlying authentication failure, and policy override. A receiver’s disposition can reflect local handling and overrides, so it is not a simple restatement of the requested p value.
Report limitations honestly
Counts cover participating reporters and their observation windows, not all global mail. Aggregate data cannot show individual message content or guarantee inbox placement. Keep missing reports, parse failures, and late reports visible.
End each review with an owner and next action for material sources: confirm, repair, retire, or investigate. The report becomes operationally useful when it updates the sender inventory and change plan, not when it is converted into a colorful pass-rate chart.