HackBlue

Labs / Email and phishing

DMARC aggregate report reader

Read one day of DMARC aggregate XML, classify every sending source, and decide whether the domain can move from p=none to p=reject yet.

  • Interactive lab
  • Intermediate
  • 5 steps
  • 0 of 5 solved

Goal

contoso.example published DMARC at p=none three months ago to collect reports before enforcing. This is one day’s aggregate report from a large mailbox provider.

Read the XML or the parsed rows, and classify every sending source. The team wants to move to p=reject, so the question is which mail is really yours and what breaks if you enforce today.

mailbox-provider.example · 2026-11-02 · p=none adkim=r aspf=r
SourceMessagesSPF (domain)DKIM (d=)DMARCYour classification
198.51.100.10mail-outbound-1.protection.example · From: contoso.example4,210pass contoso.example
aligned		pass contoso.example
aligned		pass
203.0.113.25o1.mailer.esp.example · From: news.contoso.example1,880pass bounce.esp.example
not aligned		pass contoso.example
aligned		pass
192.0.2.44lists.university.example · From: contoso.example37pass lists.university.example
not aligned		fail contoso.example
not aligned		fail
198.51.100.77out.hr-saas.example · From: contoso.example312pass hr-saas.example
not aligned		pass hr-saas.example
not aligned		fail
203.0.113.140no PTR record · From: contoso.example95fail contoso.example
not aligned		no signaturefail
192.0.2.201host-201.dsl.isp.example · From: contoso.example12softfail invoice-portal.example
not aligned		fail invoice-portal.example
not aligned		fail

0 of 6 classified.

Steps

  1. 01Classify all six sources in the report.

    Do this in the workbench above. This step completes itself when the condition is met.

  2. 02How many messages failed DMARC in this report?

  3. 03The newsletter ESP’s SPF passed for bounce.esp.example, not contoso.example. Why does DMARC still pass?

  4. 04Can contoso.example move to p=reject today?

  5. 05The university list adds a footer, breaking DKIM. What is the reasonable response?