Nonstandard DMARC report sent by Google

Question

I'm working on a system which parses DMARC reports and I figured the following issue:

Sometimes, Google sends nonstandard e-mails, as can be seen below:

MIME-Version: 1.0
X-Received: by x.x.x.x with SMTP id xxxx.xx.xxxx;
 Thu, 22 Aug 2013 02:13:03 -0700 (PDT)
Message-ID: 
Date: Thu, 22 Aug 2013 09:13:03 +0000
Subject: Report domain: example.com Submitter: google.com Report-ID: xxxxx
From: [email protected]
To: [email protected]
Content-Type: application/zip; 
    name="google.com!example.com!1377043200!1377129599.zip"
Content-Disposition: attachment; 
    filename="google.com!example.com!1377043200!1377129599.zip"

Content-Transfer-Encoding: base64

UEsDBAoAAAAIAEJIFkMWecIj/AEAAKkEAAAvAAAAZ29vZ2xlLmNvbSFsYW50aWFuLmV1ITEzNzcw
...
AAABAAEAXQAAAEkCAAAAAA==

Please take a look at the unusual break line between Content-Disposition and Content-Transfer-Encoding headers.

After the MIME standard, the content of the email should look like:

Content-Type: application/zip; 
    name="google.com!example.com!1377043200!1377129599.zip"
Content-Disposition: attachment; 
    filename="google.com!example.com!1377043200!1377129599.zip"
Content-Transfer-Encoding: base64

UEsDBAoAAAAIAEJIFkMWecIj/AEAAKkEAAAvAAAAZ29vZ2xlLmNvbSFsYW50aWFuLmV1ITEzNzcw
...
AAABAAEAXQAAAEkCAAAAAA==

This break line should not be there (you can see http://en.wikipedia.org/wiki/Multipurpose_Internet_Mail_Extensions ).

So, why Google do this?

I have noticed the same issue. It happens only to some reports and the break is never in the same place so it can't be predicted and fixed. — transilvlad

Matt Simerson Matt Simerson · Accepted Answer · 2014-05-20T05:20:37

If you were to join [email protected] and post this question there, I can assure you it would be read by a Google engineer that works on DMARC. When I wrote my DMARC implementation, I too discovered a number of variances between the reports I received and the DMARC draft spec. Not too long after reporting the variances on that list, they were all corrected.

Nonstandard DMARC report sent by Google

1 Answers