<?xml version="1.0" encoding="UTF-8" ?>
<feedback>
  <report_metadata>
    <org_name>Yahoo! Inc.</org_name>
    <email>dmarc_ruf@verizonmedia.com</email>
    <extra_contact_info>https://senders.yahooinc.com</extra_contact_info>
    <report_id>1746662400.57843.example.com</report_id>
    <date_range>
      <begin>1746576000</begin>
      <end>1746662400</end>
    </date_range>
  </report_metadata>
  <policy_published>
    <domain>example.com</domain>
    <adkim>r</adkim>
    <aspf>r</aspf>
    <p>none</p>
    <sp>none</sp>
    <pct>100</pct>
    <fo>0</fo>
  </policy_published>
  <!-- Legitimate transactional mail via own server — both aligned -->
  <record>
    <row>
      <source_ip>203.0.113.10</source_ip>
      <count>187</count>
      <policy_evaluated>
        <disposition>none</disposition>
        <dkim>pass</dkim>
        <spf>pass</spf>
      </policy_evaluated>
    </row>
    <identifiers>
      <header_from>example.com</header_from>
      <envelope_from>mail.example.com</envelope_from>
    </identifiers>
    <auth_results>
      <dkim>
        <domain>example.com</domain>
        <selector>mail2024</selector>
        <result>pass</result>
        <human_result>pass</human_result>
      </dkim>
      <spf>
        <domain>mail.example.com</domain>
        <scope>mfrom</scope>
        <result>pass</result>
      </spf>
    </auth_results>
  </record>
  <!-- Mailchimp ESP: envelope-from is mailchimp.com so SPF won't align;
       DKIM passes because Mailchimp signs with your domain key — common scenario -->
  <record>
    <row>
      <source_ip>198.2.134.144</source_ip>
      <count>94</count>
      <policy_evaluated>
        <disposition>none</disposition>
        <dkim>pass</dkim>
        <spf>fail</spf>
      </policy_evaluated>
    </row>
    <identifiers>
      <header_from>example.com</header_from>
      <envelope_from>mta.mailchimpapp.net</envelope_from>
    </identifiers>
    <auth_results>
      <dkim>
        <domain>example.com</domain>
        <selector>k1</selector>
        <result>pass</result>
        <human_result>pass</human_result>
      </dkim>
      <dkim>
        <domain>mcsv.net</domain>
        <selector>dkim</selector>
        <result>pass</result>
        <human_result>pass</human_result>
      </dkim>
      <spf>
        <domain>mta.mailchimpapp.net</domain>
        <scope>mfrom</scope>
        <result>pass</result>
      </spf>
    </auth_results>
  </record>
  <!-- Email forwarding: recipient's university forwarder rewrites envelope-from,
       breaking SPF alignment; DKIM signature survives so DMARC still passes -->
  <record>
    <row>
      <source_ip>130.211.55.90</source_ip>
      <count>12</count>
      <policy_evaluated>
        <disposition>none</disposition>
        <dkim>pass</dkim>
        <spf>fail</spf>
      </policy_evaluated>
    </row>
    <identifiers>
      <header_from>example.com</header_from>
      <envelope_from>forward.university.edu</envelope_from>
    </identifiers>
    <auth_results>
      <dkim>
        <domain>example.com</domain>
        <selector>mail2024</selector>
        <result>pass</result>
        <human_result>pass</human_result>
      </dkim>
      <spf>
        <domain>forward.university.edu</domain>
        <scope>mfrom</scope>
        <result>pass</result>
      </spf>
    </auth_results>
  </record>
  <!-- Old CRM server still sending: not in SPF record, no DKIM key configured;
       p=none means mail is delivered, but this would be rejected under p=reject -->
  <record>
    <row>
      <source_ip>10.0.0.254</source_ip>
      <count>5</count>
      <policy_evaluated>
        <disposition>none</disposition>
        <dkim>fail</dkim>
        <spf>fail</spf>
      </policy_evaluated>
    </row>
    <identifiers>
      <header_from>example.com</header_from>
      <envelope_from>crm-legacy.example.com</envelope_from>
    </identifiers>
    <auth_results>
      <dkim>
        <domain>example.com</domain>
        <selector>crm</selector>
        <result>fail</result>
        <human_result>no key for signature</human_result>
      </dkim>
      <spf>
        <domain>crm-legacy.example.com</domain>
        <scope>mfrom</scope>
        <result>softfail</result>
      </spf>
    </auth_results>
  </record>
  <!-- HubSpot CRM: added to SPF so SPF aligns; DKIM not yet configured for this domain -->
  <record>
    <row>
      <source_ip>205.201.136.11</source_ip>
      <count>31</count>
      <policy_evaluated>
        <disposition>none</disposition>
        <dkim>fail</dkim>
        <spf>pass</spf>
      </policy_evaluated>
    </row>
    <identifiers>
      <header_from>example.com</header_from>
      <envelope_from>example.com</envelope_from>
    </identifiers>
    <auth_results>
      <dkim>
        <domain>example.com</domain>
        <selector>hubspot</selector>
        <result>fail</result>
        <human_result>no key for signature</human_result>
      </dkim>
      <spf>
        <domain>example.com</domain>
        <scope>mfrom</scope>
        <result>pass</result>
      </spf>
    </auth_results>
  </record>
  <!-- Spoofing attempt that slips through because p=none — domain still in monitoring mode -->
  <record>
    <row>
      <source_ip>45.142.212.100</source_ip>
      <count>3</count>
      <policy_evaluated>
        <disposition>none</disposition>
        <dkim>fail</dkim>
        <spf>fail</spf>
        <reason>
          <type>other</type>
          <comment>DMARC failure — not rejected because policy is p=none (monitoring only)</comment>
        </reason>
      </policy_evaluated>
    </row>
    <identifiers>
      <header_from>example.com</header_from>
      <envelope_from>info.example-com.phish.ru</envelope_from>
    </identifiers>
    <auth_results>
      <dkim>
        <domain>example.com</domain>
        <selector>default</selector>
        <result>fail</result>
        <human_result>signature did not verify</human_result>
      </dkim>
      <spf>
        <domain>info.example-com.phish.ru</domain>
        <scope>mfrom</scope>
        <result>fail</result>
      </spf>
    </auth_results>
  </record>
</feedback>
