On Sun 27/Sep/2020 09:14:46 +0200 Blason R via dmarc-discuss wrote:
Hi Folks,
I am starting with DMARC implementation and analysing the XML report without
any GUI tool just to clear my understanding. Can someone please confirm if
below marked in *bold* is correct?
Yup, it sounds correct.
<policy_published>
<domain>example.com</domain> ==> DMARC Policy published by our domain
example.com; referred by Reporting ORG?
Example.org is the domain where the reporting ORG got a DMARC record from.
That is, the From: domain of the messages reported in a given report.
<adkim>r</adkim>
<aspf>r</aspf>
<p>none</p>
<pct>100</pct>
<fo>0</fo>
</policy_published>
[...]
<policy_evaluated>
<disposition>none</disposition> *==> Action taken on the mail by Reporting
Org??*
Just how evaluating the policy affected the action. For example, consider a
message which got 15 spam points and was therefore quarantined. That has
nothing to do with DMARC, so "none" can be correct.
Some say "pass" instead of "none", meaning the same.
<dkim>pass</dkim>
<spf>pass</spf>
That includes alignment considerations.
</policy_evaluated> *--> What Policy is evaluated*
It should be the policy referred as "published" above. Some reporting ORGs
send multiple records in case a sender changes policy during the day,
collecting the corresponding evaluations. I wouldn't count much on that;
reports about policy changes should be interpreted with a grain of salt.
Best
Ale
--
_______________________________________________
dmarc-discuss mailing list
dmarc-discuss@dmarc.org
http://www.dmarc.org/mailman/listinfo/dmarc-discuss
NOTE: Participating in this list means you agree to the DMARC Note Well terms
(http://www.dmarc.org/note_well.html)
