Here is an evaluation of 84k aggregate reports in the timespan of 2020-2024.
481 reporting organizations
derived from 896 distinct <org_name> strings
---+---
44 use Organization Names ("Example")
with min=1, median=1.0, mean=1.11, max=3 distinct names
344 use Organizational Domains only ("example.net")
with min=1, median=1.0, mean=1.05, max=10 distinct domains
93 use Hostnames and Domains ("mx1.example.net")
with min=1, median=2, mean=5.23, max=315 distinct hosts
---+---
364 report version
2 report version__other
0 report meta_error
450 report sp
340 report sp__empty
39 report fo__v1
0 report fo__v1empty
69 report override_reason
21 report envelope_to
354 report envelope_from__v1
119 report envelope_from__v1empty
18 report envelope_from__v1missing
3 report dkim_selector__empty
94 report dkim_selector__missing
18 report dkim_result__none
19 report dkim_human_result
17 report dkim_human_result__copy
357 report spf_scope__v1
---+---
Human-comprehensible result:
- 76% (364/481) of reporters announce the use of the RFC 7489
<version>1.0</version> schema.
- No one seems to use <error> below <report_metadata>.
- 71% (340/481) report an empty <sp></sp> instead of the default value.
- 11% (39/364) of 1.0 reporters include the <fo> element, although it's
actually mandatory. Draft schema does not have <fo>.
<identifiers>:
- 4% (21/481) use <envelope_to>.
- 97% (351/364) of 1.0 reporters use <envelope_from>. Draft schema does
not have <envelope_from>.
- 33% (119/364) have used an empty <envelope_from> (i.e., reported a
bounce) at least once.
- 5% (18/364) have omitted <envelope_from> at least once, even though
it is mandatory in 1.0.
- The remaining 62% either did not receive a bounce or do not report
bounces.
<dkim>:
- 20% (94/481) have omitted the optional <selector> in a DKIM result at
least once.
- 4% (18/481) have reported a DKIM <result>none</result>, even though
they could've instead omit the <dkim> element altogether.
- 4% (19/481) have used the DKIM <human_result>, but only 2 used it for
extra information that was not just a copy of <result>.
Regards,
Matt
_______________________________________________
dmarc mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/dmarc
