The purpose of email address mentioned in <email> tag

Technical Help
1

What is the purpose of email tag in XML reports “report_metadata” section ?

<?xml version="1.0" encoding="UTF-8" ?>
<feedback>
  <version>1.0</version>
  <report_metadata>
    <org_name>esa2.hc3179-65.iphmx.com</org_name>
    <email>MAILER-DAEMON@esa2.hc3179-65.iphmx.com</email>
    <extra_contact_info>
    </extra_contact_info>
    <report_id>03118e$b16f6a2=9c1de6568a9ba4f4@esa2.hc3179-65.iphmx.com</report_id>
    <date_range>
      <begin>1567717203</begin>
      <end>1567803604</end>
    </date_range>
  </report_metadata>

I did not find any description of this, as well as other, tags from that section in DMARC RFC

Is it just a dummy (not necessary existing) email address which DMARC Aggregate reports are coming from ?

Or this address should accept inbound emails, e.g. for receiving feedbacks regarding issues found in XML reports formatting, etc ?

2

The address given there should be legitimate, and checked for legitimate content once in a while. The primary legitimate use case is for aggregators to contact the report generator to provide feedback on problems in their report generation. Without this contact information it can be difficult to impossible to begin a discussion such as
"Please try to make your reporting timeframe match what the RFC recommends: midnight UTC to midnight UTC. Your current report is pretty unusual, 86401 seconds

From
1567717203 (Thursday, September 5, 2019 9:00:03 PM)
to
1567803604 (Friday, September 6, 2019 9:00:04 PM)

I do know that in this case the issue is a known bug with the Cisco ESA’s DMARC implementation, but you get the idea: the address should be legitimate in order for feedback to be given.

1 Like
3

Actually, looking on DMARC XML reports I receive, I see that many XML feeders use “no-reply” (e.g. Google, Yahoo) or “mailer-daemon” addresses, and replies to that addresses are bouncing in most cases.

Apparently most of DMARC aggregate report feeders send reports from not-existing email address. I guess, to avoid floods ?