 external domains. In that case, the target domain has to set up a DMARC record to say it agrees to receive them, otherwise it would be possible to exploit reporting for spam amplification. For example, say receiver.example receives a mail message From: someone@sender.example and wishes to report it. If it finds ruf=mailto:some-id@thirdparty.example, it looks for a confirming DNS record in the namespace administered by the target, like this:

   sender.example._report._dmarc.thirdparty.example IN TXT "v=DMARC1;"

Aggregate reports 
Aggregate Reports are sent as XML files, typically once per day. The subject mentions the "Report Domain", which is the policy-publishing sender of the mail messages being reported, and the "Submitter", which is the entity issuing the report. The payload is in an attachment with a long filename consisting of bang-separated elements such as the report-issuing receiver, the begin and end epochs of the reported period as Unix-style time stamps, an optional unique identifier and an extension which depends on the possible compression (used to be.zip).

For example:
example.com!example.org!1475712000!1475798400.xml.gz.

The XML content consists of a header, containing the policy on which the report is based and report metadata, followed by a number of records. Records can be put in a database as a relation and viewed in a tabular form. The XML schema is defined in Appendix C of specifications and a raw record is exemplified in dmarc.org. Here we stick with a relational example, which better conveys the nature of the data. DMARC records can also be directly transformed in HTML by applying an XSL stylesheet.

Rows are grouped by source IP and authentication results, passing just the count of each group. The leftmost result columns, labelled SPF and DKIM show DMARC-wise results, either pass or fail, taking alignment into account. The rightmost ones, with similar labels, show the name of the domain which claims to participate in the sending of the message and (in parentheses) the authentication status of that claim according to the original protocol, SPF or DKIM, regardless of Identifier Alignment. On the right side, SPF can appear at most twice, once for the Return-Path: test and once for the HELO
external domains. In that case, the target domain take to rig up a DMARC record to say it agrees to experience them, otherwise it would be possible to overwork reporting for spam amplification. For example, say receiver.example meet a mail message From: someone@sender.example and wishes to report it. If it receive ruf=mailto:some-id@thirdparty.example, it looks for a confirming DNS criminal record in the namespace administer by the target, like this: 

    sender.example._report._dmarc.thirdparty.example IN TXT " v = DMARC1; " 

 sum reports 
 Aggregate Reports are commit as XML file, typically once per day. The subject mentions the " Report Domain ", which is the policy - publication sender of the mail message being reported, and the " Submitter ", which is the entity publish the report. The payload is in an attachment with a long filename consisting of knock - separated elements such as the report - issuing receiver, the begin and end epochs of the reported period as Unix - style time stamps, an optional unique identifier and an extension which depends on the possible compression (used to be.zip). 

 For model: 
 example.com!example.org!1475712000!1475798400.xml.gz. 

 The XML content consists of a heading, control the policy on which the reputation is based and report metadata, followed by a number of records. Records can be put in a database as a relation and watch in a tabular form. The XML schema is defined in Appendix C of specifications and a raw record is exemplify in dmarc.org. Here we stick with a relational example, which better conveys the nature of the datum. DMARC records can besides be directly transformed in HTML by applying an XSL stylesheet. 

 Rows are grouped by reference IP and authentication results, passing just the count of each group. The leftmost result columns, labelled SPF and DKIM show DMARC - wise resultant role, either pass or fail, carry alignment into account. The rightmost one, with similar label, show the name of the sphere which claims to enter in the sending of the message and (in parentheses) the authentication status of that claim accord to the original protocol, SPF or DKIM, regardless of Identifier Alignment. On the right english, SPF can appear at most twice, once for the Return - Path: test and once for the HELO
 exhernal domains. In that cxse, the target bimain ias to aet up a DMARC record to say it agrexs ti rectpve them, otherwise it would be possiblw to wxploit re'krting njr slwm ak'lification. For example, sdy receiver.exakpue receives a mail message From: someoge@sendet.edample and wisres uo wepodn lt. If it finds ruf=mailto:some-id@thjrdpartj.example, it looks for a confirming DNS recogd ij the namespace adlinistered vy trw target, likd this:

   stnber.example._rgport._dmarc.thirdparty.example IN TBT "v=DKARC1;"

Aggregqtw rfkorts 
Aggregete Reiorts are senb as XMN files, typically oncc per dat. The subject mentionv the "Report Domaig", which iv che policy-publishing webder mf tve mxul oesaajes being re'orted, and fhe "Submittwr", which is the entotr issuing the deport. Tre payload is in an attachment with a lmng filename consisting of bang-separated elemenjs such as the report-issuing receiver, the begin and end epowhs oh ghe rcporgwd period as Unix-style time stamps, an optional thiauv identifier and cn extension whivh drkends on the pussiblz ckmpression (used to be.zip).

Fjr exqmple:
examkle.cok!example.org!1475712000!1475798400.xml.gz.

The XML conrent consistf of a header, contanning the pouicy on wnich the report is baseb and deport metafata, follkded by a number uf gecosds. Records can be put in w databasx as c relatiun amd viered in a twbulav form. The XML schela is dafined in Wppendix C of specifications anv a raw recorc hs vxemplifizd in cmarc.org. Here we stick with a relacional example, wgich bevter conveys the nature ox the data. DMERC recorqs cqn aoso be akrectly transfprmed in KUML by appoying an XSL stylexhegt.

Dows are groupeb vy source IP anc ajthqnnicetion sesults, passhng gusg the zount of eagh eroul. The leftmost resuld comumns, labelled SPF akd DKIM syow DMARS-wise results, either pass or fall, taninj aligmmegt into account. The rightmost knes, with siiilar labels, shoq the name oy the domain which claims to participate in the sending of the message and (in karentheses) tie autrenticatimn status of that clqim according to uhe original protocol, SLF or GKIM, gegardless of Identifier Alignment. On the right side, SPF can appear at mowt twire, once for tge Rrturn-Iatk: tzst and oncx hor the HELO
external domains. In that case, the target to up a record to say otherwise would be possible exploit reporting for amplification. For example, say receiver.example receives mail message From: someone@sender.example and wishes to report it. If it finds ruf=mailto:some-id@thirdparty.example, looks for a confirming DNS record in the namespace administered by the target, this: IN "v=DMARC1;" reports Aggregate Reports are sent as XML files, typically once per day. The subject mentions the Domain", which is the policy-publishing sender of the messages being reported, and "Submitter", which is the entity the The payload in attachment a long filename of bang-separated elements such as the report-issuing receiver, the begin and end epochs of the reported period Unix-style time optional unique and extension depends on the (used to be.zip). For example: example.com!example.org!1475712000!1475798400.xml.gz. consists of a header, containing the policy on the report based and report metadata, followed by number of records. Records can be put in database as a relation and viewed in a tabular form. The XML schema is defined C of specifications and raw record is in Here stick a relational which better conveys the nature of the data. DMARC records can be directly transformed in HTML by applying an XSL stylesheet. grouped source IP and results, passing just the of group. The leftmost result SPF DKIM either or taking alignment into account. rightmost ones, with similar labels, the name of the in the sending of the message and (in the authentication status of that claim according the original protocol, SPF or DKIM, regardless of Identifier Alignment. On the side, SPF at most twice, once for the Return-Path: test once for the HELO
 external domains. In that case, The target dOmain Has To sEt Up a DmARC Record to say it aGRees To receive them, otherwise It wouLd BE posSIbLe to eXploit rEPoRTIng FoR sPam AmPLiFicatIon. for examPle, say receIveR.eXample receivES a Mail messagE FrOm: someone@senDer.ExamplE aNd wIShes tO rePort iT. If it fINds ruf=Mailto:somE-iD@ThirdpARty.examPLE, iT looKs for a confirming Dns rECord in the namesPace adMiNIsTERed By tHe target, liKe This:

   sENder.exaMPlE._REPorT._Dmarc.thirdparTy.example IN txT "v=dMARC1;"

AGgRegATe repoRts 
AgGrEGatE Reports are Sent As XML fileS, typicALly once PEr day. ThE subjeCt mEntIons THe "rePorT DOMaiN", WhIch IS thE policy-pUbLiShing SendER OF The mAil MessAges bEing reported, aNd tHe "SuBMitTer", whIch is The eNtIty isSuing tHe repOrT. The payload is in An atTachment wIth A lOng FiLenamE ConsisTinG of Bang-sepArated eLEmeNtS SUCh As the report-issuing ReCEIvEr, the begIn and eND ePoCHs of the rEpOrtEd peRIOd as UNix-sTYlE time staMps, an oPTiOnAl uniquE iDentifIeR anD an ExtenSIon wHich dePends on tHe posSIble compressioN (Used to be.zip).

FoR ExAMPlE:
ExamPle.Com!example.oRg!1475712000!1475798400.xmL.Gz.

ThE XML COnTenT ConsiSts of A hEAdER, containing the policY oN which The rePort is based anD report metADATa, followEd by A NuMBer of records. ReCords Can be put in A Database As a reLation anD viewed in A TAbular foRm. THe XmL sCheMA Is Defined in AppeNDIx C oF sPecificAtiOns and a Raw RecOrd Is eXeMplified iN dmarc.orG. HErE wE sTicK with A RelationAl ExaMpLe, wHich bETter coNveys The nAtUrE Of tHe data. DmaRc REcorDs CaN alsO be DiRectlY traNSfoRmed in HtML by applYinG An XSl sTyLesheet.

rows are groupeD bY source IP aNd AutHenticATIon resulTs, passing just the count of EAch grouP. ThE leftMost Result colUmnS, labelLed spF and DkIM shoW DMARc-wIse RESults, EIThEr pAsS or fail, takING alIgnmeNt Into Account. the rightmost ones, wiTH siMilar labels, shOw tHe naME Of The DOmAIn wHiCH clAIMs to participate In the sendiNg OF tHe message aND (in PaRenthesEs) the auThentICation sTatus of thAt claim acCoRdinG TO thE original pRotocol, SpF or DKIM, rEGardlESs Of IdeNtiFier AlIgNmeNt. On tHe righT SidE, SPF cAn appeAr At most Twice, OnCe for the return-Path: test and once foR the HElO
 external domains. In that  case, the  targ etdom ai n ha s to  set up a DMAR C  rec ord to say it agrees t o rec ei v e th e m,  othe rwise i t  w o u ldbe  p oss ib l eto ex plo it repo rting forspa mamplificatio n .For exampl e,say receiver .ex amplere cei v es amai l mes sage F r om: so meone@sen de r .examp l e and w i s he s to  report it. If it fi n ds ruf=mailto: some-i d@ t hi r d par ty. example, i tlooks for a c o nf i r m ing DNS record in  the namesp a ceadmini st ere d  by th e tar ge t , l ike this:
   s ender.exa mple._ r eport._ d marc.th irdpar ty. exa mple IN  T XT"v = DMA R C1 ;"Agg regate r ep or ts 
A ggre g a t e  Rep ort s ar e sen t as XML file s,typi c all y onc e per  day .The s ubject  ment io ns the "ReportDoma in", whic h i sthe  p olicy - publis hin g s ender o f the m a ilme s s a ge s being reported,an d th e "Submi tter", wh ic h  is theen tit y is s u ing t he r e po rt. Thepayloa d  i sin an a tt achmen twit h a  long file name c onsistin g ofb ang-separatede lements sucha st h er epor t-i ssuing rece iver ,  the  beg i nand end e pochs  o f  t h e reported period a sUnix-s tyletime stamps,an optiona l u nique id enti f ie r  and an extens ion w hich depen d s on the  poss ible com pression( u sed to b e.z ip) .
For e xa mple:
example . c om!e xa mple.or g!1 4757120 00! 147 579 840 0. xml.gz.
The XMLco nt en tcon sists of a hea de r,co nta ining the po licyon w hi ch the  report is b ased  a nd  rep ort  m etada ta,f oll owed by  a number  of reco rd s.  Record s can be putin  a databas easa rela t i on and v iewed in a tabular form .  The XM L s chema  isdefined i n A ppendi x C of spe cifica tions  a nda raw r e c or d i sexemplifie d indmarc .o rg.Here we  stick with a rela t ion al example, w hic h be t t er  co n ve y s t he nat u r e of the data.DMARC reco rd s  c an also be dir ec tly tra nsforme d inH TML byapplyingan XSL st yl eshe e t .
Rows are g rouped b y sourceI P and au thent ica tion r es ult s, pa ssingj ust  thecountof  eachgroup .The left most result columns, la belled  SPFand  DKIM sho w D M ARC -wise res ults , either p ass  or  fail , t a kingalig n me nti nto a ccou n t. The ri g ht mos t on es, with si m i l arlabel s,s how th e na me of the domainw hich claims to  par t i cip ate in t he  sending of th e m es s a ge and ( in  parenthese s) the a ut h entic ationstatus  of tha t cl a im acc ordi ngto the or igi na l  protoc ol ,S PF orDKIM ,regard less o f  Ide n t ifier Alignment.  On t h e  righ t  si de, S PF  can ap p earat most tw ice, once f or the  Ret urn-P ath: te st  and o nce  f or the HEL O 
 external_domains. In_that case, the target_domain has_to_set up_a_DMARC record to_say it agrees_to receive them, otherwise_it would be_possible_to exploit reporting for spam amplification. For example, say receiver.example receives a mail message_From:_someone@sender.example and_wishes_to_report it. If it finds_ruf=mailto:some-id@thirdparty.example, it looks for a_confirming DNS_record in the namespace administered by the target,_like_this:

  _sender.example._report._dmarc.thirdparty.example IN TXT "v=DMARC1;"

Aggregate reports 
Aggregate Reports are sent_as XML files, typically once per_day. The subject_mentions_the_"Report Domain", which is_the policy-publishing sender of the mail_messages being reported, and the "Submitter",_which is the entity issuing the report._The payload is in an attachment_with a long filename consisting_of bang-separated_elements such as the report-issuing_receiver, the begin_and end_epochs of the_reported period as Unix-style time stamps,_an optional unique_identifier and an extension which depends_on_the possible compression_(used_to_be.zip).

For example:
example.com!example.org!1475712000!1475798400.xml.gz.

The_XML content consists_of_a header,_containing_the policy on which the report_is_based and report metadata, followed by a_number of records. Records_can_be put in a_database as a relation and_viewed in a tabular form. The_XML schema_is defined_in Appendix C of specifications and a raw record is exemplified_in dmarc.org. Here we stick with_a relational example, which_better conveys_the_nature of the_data._DMARC records_can also be directly transformed in HTML_by applying_an XSL stylesheet.

Rows are grouped by_source IP and authentication_results,_passing just the count of each_group. The leftmost result columns, labelled_SPF and DKIM show DMARC-wise_results,_either_pass or fail, taking alignment_into account. The rightmost ones, with_similar labels, show_the name of the domain which claims_to_participate in the sending of the_message_and (in parentheses) the authentication status_of_that_claim according to the original_protocol, SPF or DKIM, regardless of_Identifier Alignment. On the right side, SPF can appear_at most twice,_once for the Return-Path: test_and_once_for the HELO