Internet Assigned Numbers Authority • Domains • Protocols • Numbers • About Messaging Abuse Reporting Format (MARF) Parameters Created 2010-05-26 Last Updated 2026-05-22 Available Formats [IMG] XML [IMG] HTML [IMG] TXT Registries Included Below • Feedback Report Header Fields • Feedback Report Type Values Feedback Report Header Fields Registration Procedure(s) Specification Required Expert(s) Scott Kitterman, Murray Kucherawy Reference [RFC 5965] Available Formats [IMG] CSV Field Name Description Multiple Appearances Related "Feedback-Type" Reference Status Arrival-Date date/time the original message was received No any [RFC 5965] current Auth-Failure Type of email authentication method failure No auth-failure [RFC 6591] current Authentication-Results results of authentication check(s) Yes any [RFC 5965] current Delivery-Result Final disposition of the subject message No auth-failure [RFC 6591] current DKIM-ADSP-DNS Retrieved DKIM ADSP record No auth-failure [RFC 6591] current DKIM-Canonicalized-Body Canonicalized body, per DKIM No auth-failure [RFC 6591] current DKIM-Canonicalized-Header Canonicalized header, per DKIM No auth-failure [RFC 6591] current DKIM-Domain DKIM signing domain from "d=" tag No auth-failure [RFC 6591] current DKIM-Identity Identity from DKIM signature No auth-failure [RFC 6591] current DKIM-Selector Selector from DKIM signature No auth-failure [RFC 6591] current DKIM-Selector-DNS Retrieved DKIM key record No auth-failure [RFC 6591] current Feedback-Type registered feedback report type No N/A [RFC 5965] current Incidents expression of how many similar incidents are represented by No any [RFC 5965] current this report Original-Mail-From email address used in the MAIL FROM portion of the original No any [RFC 5965] current SMTP transaction Original-Rcpt-To email address used in the RCPT TO portion of the original Yes any [RFC 5965] current SMTP transaction Received-Date date/time the original message was received (replaced by No any [RFC 5965] historic "Arrival-Date") Reported-Domain a domain name the report generator considers to be key to Yes any [RFC 5965] current the message about which a report is being generated Reported-URI a URI the report generator considers to be key to the Yes any [RFC 5965] current message about which a report is being generated Reporting-MTA MTA generating this report No any [RFC 5965] current Source-IP IPv4 or IPv6 address from which the original message was No any [RFC 5965] current received SPF-DNS Retrieved SPF record No auth-failure [RFC 6591] current User-Agent name and version of the program generating the report No any [RFC 5965] current Version version of specification used No any [RFC 5965] current Source-Port TCP source port from which the original message was No any [RFC 6692] current received a list of authentication mechanism names that failed to Identity-Alignment authenticate an aligned identity, or "none" if all were No auth-failure [RFC 9991] current successful Feedback Report Type Values Registration Procedure(s) Specification Required Expert(s) Scott Kitterman, Murray Kucherawy Reference [RFC 5965] Available Formats [IMG] CSV Feedback Type Name Description Reference Status abuse unsolicited email or some other kind of email abuse [RFC 5965] current auth-failure email authentication failure report [RFC 6591] current fraud indicates some kind of fraud or phishing activity [RFC 5965] current not-spam Indicates that the entity providing the report does not consider the message to be spam. This may be used to [RFC 6430] current correct a message that was incorrectly tagged or categorized as spam. other any other feedback that does not fit into other registered types [RFC 5965] current virus report of a virus found in the originating message [RFC 5965] current Licensing Terms