<?xml version="1.0" encoding="UTF-8" ?>
<feedback>
  <report_metadata>
    <org_name>Microsoft Corporation</org_name>
    <email>dmarcreport@microsoft.com</email>
    <extra_contact_info>https://go.microsoft.com/fwlink/?LinkID=320049</extra_contact_info>
    <report_id>20260506T000000Z_example.com_outlook.com</report_id>
    <date_range>
      <begin>1746576000</begin>
      <end>1746662400</end>
    </date_range>
  </report_metadata>
  <policy_published>
    <domain>example.com</domain>
    <adkim>s</adkim>
    <aspf>s</aspf>
    <p>reject</p>
    <sp>reject</sp>
    <pct>100</pct>
    <fo>1</fo>
  </policy_published>
  <!-- Legitimate Microsoft 365 outbound mail — fully aligned -->
  <record>
    <row>
      <source_ip>40.107.93.12</source_ip>
      <count>312</count>
      <policy_evaluated>
        <disposition>none</disposition>
        <dkim>pass</dkim>
        <spf>pass</spf>
      </policy_evaluated>
    </row>
    <identifiers>
      <header_from>example.com</header_from>
      <envelope_from>example.com</envelope_from>
    </identifiers>
    <auth_results>
      <dkim>
        <domain>example.com</domain>
        <selector>selector1</selector>
        <result>pass</result>
        <human_result>pass</human_result>
      </dkim>
      <spf>
        <domain>example.com</domain>
        <scope>mfrom</scope>
        <result>pass</result>
      </spf>
    </auth_results>
  </record>
  <!-- Botnet cluster spoofing example.com — DKIM/SPF both fail, rejected -->
  <record>
    <row>
      <source_ip>185.220.101.47</source_ip>
      <count>78</count>
      <policy_evaluated>
        <disposition>reject</disposition>
        <dkim>fail</dkim>
        <spf>fail</spf>
        <reason>
          <type>other</type>
          <comment>DMARC failure: unauthorized sender impersonating example.com</comment>
        </reason>
      </policy_evaluated>
    </row>
    <identifiers>
      <header_from>example.com</header_from>
      <envelope_from>noreply.bulk-mailer.net</envelope_from>
    </identifiers>
    <auth_results>
      <dkim>
        <domain>example.com</domain>
        <selector>default</selector>
        <result>fail</result>
        <human_result>signature did not verify</human_result>
      </dkim>
      <spf>
        <domain>noreply.bulk-mailer.net</domain>
        <scope>mfrom</scope>
        <result>fail</result>
      </spf>
    </auth_results>
  </record>
  <!-- Known spam host pretending to be example.com, rejected -->
  <record>
    <row>
      <source_ip>91.240.118.201</source_ip>
      <count>45</count>
      <policy_evaluated>
        <disposition>reject</disposition>
        <dkim>fail</dkim>
        <spf>fail</spf>
        <reason>
          <type>other</type>
          <comment>DMARC failure: spoofed From header, no valid DKIM or SPF alignment</comment>
        </reason>
      </policy_evaluated>
    </row>
    <identifiers>
      <header_from>example.com</header_from>
      <envelope_from>mail.spam-relay-91.com</envelope_from>
    </identifiers>
    <auth_results>
      <dkim>
        <domain>example.com</domain>
        <selector>mail</selector>
        <result>fail</result>
        <human_result>no key for signature</human_result>
      </dkim>
      <spf>
        <domain>mail.spam-relay-91.com</domain>
        <scope>mfrom</scope>
        <result>fail</result>
      </spf>
    </auth_results>
  </record>
  <!-- Phishing kit sending credential-harvesting mails as example.com -->
  <record>
    <row>
      <source_ip>103.75.188.93</source_ip>
      <count>19</count>
      <policy_evaluated>
        <disposition>reject</disposition>
        <dkim>fail</dkim>
        <spf>fail</spf>
        <reason>
          <type>other</type>
          <comment>Likely phishing: mismatched envelope domain, DKIM forgery attempt</comment>
        </reason>
      </policy_evaluated>
    </row>
    <identifiers>
      <header_from>example.com</header_from>
      <envelope_from>support.examp1e-helpdesk.xyz</envelope_from>
    </identifiers>
    <auth_results>
      <dkim>
        <domain>example.com</domain>
        <selector>dkim</selector>
        <result>fail</result>
        <human_result>body hash did not verify</human_result>
      </dkim>
      <spf>
        <domain>support.examp1e-helpdesk.xyz</domain>
        <scope>mfrom</scope>
        <result>fail</result>
      </spf>
    </auth_results>
  </record>
  <!-- Compromised shared hosting account used to spoof, rejected -->
  <record>
    <row>
      <source_ip>217.21.88.134</source_ip>
      <count>8</count>
      <policy_evaluated>
        <disposition>reject</disposition>
        <dkim>fail</dkim>
        <spf>fail</spf>
        <reason>
          <type>other</type>
          <comment>DMARC failure: shared hosting IP, not authorised to send for example.com</comment>
        </reason>
      </policy_evaluated>
    </row>
    <identifiers>
      <header_from>example.com</header_from>
      <envelope_from>webmaster.shared-host-cpanel.com</envelope_from>
    </identifiers>
    <auth_results>
      <dkim>
        <domain>example.com</domain>
        <selector>s1</selector>
        <result>fail</result>
        <human_result>signature did not verify</human_result>
      </dkim>
      <spf>
        <domain>webmaster.shared-host-cpanel.com</domain>
        <scope>mfrom</scope>
        <result>fail</result>
      </spf>
    </auth_results>
  </record>
</feedback>
