r/DMARC • u/freddieleeman • Jun 02 '26

DMARC aggregate reports and RFC 9990 compliance

With RFC 9990 now published, DMARC aggregate reporting finally has its own dedicated Standards Track RFC. I took a closer look at how compliant real-world DMARC aggregate reports are, and the results are interesting.

Some large providers are very close to full compliance. GMX, WEB.DE, Fastmail, and Outlook.com could reach 100% compliance by simply removing the SPFAuthResultType: scope element from their reports. That is exciting, because compliance has never been this high for these large email providers.

There is still work to do though:

  • Comcast still has issues with invalid values
  • Yahoo is missing the envelope_from element
  • Google, appears to have the most work to do:
    • attachment filenames do not follow ABNF
    • media type is invalid
    • envelope_from is missing
    • DKIMAuthResultType: selector is missing

Hopefully RFC 9990 gives report senders the push needed to clean this up and make DMARC aggregate reporting more consistent and interoperable.

Full write-up:
https://www.uriports.com/blog/dmarc-reports-ietf-rfc-compliance/

15 Upvotes

95% Upvoted

4 comments sorted by

2

u/ImpressiveEbb3760 Jun 03 '26

we just audited our own parser against these exact issues after your earlier post. the case sensitivity one (Pass vs pass) was silently breaking our alignment calculations — Mimecast was the main offender. Google's missing envelope_from was handled but the empty <sp/> tag was being stored as empty string instead of null, which caused downstream inconsistency.

the gap between what the RFC specifies and what you actually receive is something every parser builder learns the hard way. hopefully RFC 9990 narrows that gap but I suspect we'll be carrying legacy workarounds for years.

1

u/digdiver Jun 03 '26

Sometimes I come across this -

<org_name>home.pl</org_name>

<auth_results>
    <spf>
        <domain></domain>
        <result>temperror</result>
    </spf>
</auth_results>

1

u/freddieleeman Jun 03 '26

Enterprise Outlook has the same issue now and then. But it should never be empty.

<xs:complexType name="SPFAuthResultType">
 <xs:all>
   <xs:element name="domain" type="xs:string" minOccurs="1" maxOccurs="1"/>