Messaging Abuse Reporting Format (MARF) Parameters

Created

  • 2010-05-26

Last Updated

  • 2026-05-22

Available Formats

Feedback Report Header Fields

Registration Procedure(s)

  • Specification Required

Expert(s)

  • Scott Kitterman, Murray Kucherawy

Reference

  • RFC 5965: An Extensible Format for Email Feedback Reports

Available Formats

Field Name Description Multiple Appearances Related "Feedback-Type" Reference Status
Arrival-Date date/time the original message was received No any RFC 5965 current
Auth-Failure Type of email authentication method failure No auth-failure RFC 6591 current
Authentication-Results results of authentication check(s) Yes any RFC 5965 current
Delivery-Result Final disposition of the subject message No auth-failure RFC 6591 current
DKIM-ADSP-DNS Retrieved DKIM ADSP record No auth-failure RFC 6591 current
DKIM-Canonicalized-Body Canonicalized body, per DKIM No auth-failure RFC 6591 current
DKIM-Canonicalized-Header Canonicalized header, per DKIM No auth-failure RFC 6591 current
DKIM-Domain DKIM signing domain from "d=" tag No auth-failure RFC 6591 current
DKIM-Identity Identity from DKIM signature No auth-failure RFC 6591 current
DKIM-Selector Selector from DKIM signature No auth-failure RFC 6591 current
DKIM-Selector-DNS Retrieved DKIM key record No auth-failure RFC 6591 current
Feedback-Type registered feedback report type No N/A RFC 5965 current
Incidents expression of how many similar incidents are represented by this report No any RFC 5965 current
Original-Mail-From email address used in the MAIL FROM portion of the original SMTP transaction No any RFC 5965 current
Original-Rcpt-To email address used in the RCPT TO portion of the original SMTP transaction Yes any RFC 5965 current
Received-Date date/time the original message was received (replaced by "Arrival-Date") No any RFC 5965 historic
Reported-Domain a domain name the report generator considers to be key to the message about which a report is being generated Yes any RFC 5965 current
Reported-URI a URI the report generator considers to be key to the message about which a report is being generated Yes any RFC 5965 current
Reporting-MTA MTA generating this report No any RFC 5965 current
Source-IP IPv4 or IPv6 address from which the original message was received No any RFC 5965 current
SPF-DNS Retrieved SPF record No auth-failure RFC 6591 current
User-Agent name and version of the program generating the report No any RFC 5965 current
Version version of specification used No any RFC 5965 current
Source-Port TCP source port from which the original message was received No any RFC 6692 current
Identity-Alignment a list of authentication mechanism names that failed to authenticate an aligned identity, or "none" if all were successful No auth-failure RFC 9991 current

Feedback Report Type Values

Registration Procedure(s)

  • Specification Required

Expert(s)

  • Scott Kitterman, Murray Kucherawy

Reference

  • RFC 5965: An Extensible Format for Email Feedback Reports

Available Formats

Feedback Type Name Description Reference Status
abuse unsolicited email or some other kind of email abuse RFC 5965 current
auth-failure email authentication failure report RFC 6591 current
fraud indicates some kind of fraud or phishing activity RFC 5965 current
not-spam Indicates that the entity providing the report does not consider the message to be spam. This may be used to correct a message that was incorrectly tagged or categorized as spam. RFC 6430 current
other any other feedback that does not fit into other registered types RFC 5965 current
virus report of a virus found in the originating message RFC 5965 current