The fact that DMARC aggregate reports are still XML in 2026 is genuinely insane to me

I've been staring at RUA reports for years now and I cannot get over the fact that the entire DMARC reporting ecosystem is built on gzipped XML files emailed to a mailbox. EMAILED. In 2026.

Think about this for a second. The mechanism to report on email authentication failures is... more email. Email that has to be authenticated. Email that can itself be blocked, filtered, bounced, or silently dropped. Email that arrives in wildly inconsistent formats from every mailbox provider because the RFC left just enough room for everyone to be slightly creative with it.

And the format itself. XML. Not JSON, not a proper API endpoint, not anything a modern tool would ever choose. XML schemas that different providers interpret differently, with optional fields that are sometimes there and sometimes not, with timestamp formats that vary, with identifier fields that may or may not be populated. I have seen reports where the source IP is in one field from Google and a completely different field from Yahoo for what is functionally the same data.

And don't get me started on the fact that there is no standard for delivery failure of the reports themselves. If your RUA mailbox breaks, you just... stop getting data. No alert, no heads up, nothing. You find out three weeks later when you notice the dashboard went quiet.

The entire foundation of modern email authentication visibility is held together with gzip and hope. end of rant