An authentication export is useful only if its recipient can tell what was counted, where it came from and which transformations changed it. A CSV containing a domain and a pass percentage is not enough to reconstruct an investigation. Build a small evidence package around the export rather than treating the spreadsheet as the original source.
Define the exported population
References: RFC 9990 §3.1.1.8, RFC 9989 §5.3.8.
Write down the author domains, reporting intervals, participating reporters and included authentication categories. State whether the dataset covers all observed traffic, verified legitimate services or a narrower incident cohort. Use message observations as the unit when summing aggregate record counts. Report rows, submitted messages and recipient deliveries are different units.
RFC 9990 defines report metadata, record counts and evaluation fields. It does not turn participating receivers into a complete census. Do not label an export as all company email unless a separate reconciliation actually supports that claim. Preserve unclassified observations instead of silently removing them from the denominator.
Preserve a traceable source layer
References: RFC 9990 §3.5.1, RFC 9990 §3.5.4.
Retain a protected reference to each original attachment, its cryptographic fingerprint, arrival time, reporter identity, report identifier and covered interval. A fingerprint helps detect byte changes; it does not prove that the reporter's claims are truthful. Keep the report's asserted identity distinct from any independently established origin evidence.
Give every exported record a source reference and transformation version. Record parser version, schema handling, duplicate decisions and rejected-input counts. If two attachments claim the same report identity but contain different data, retain the conflict and its resolution rather than assigning both the same unquestioned provenance.
Keep raw fields apart from interpretation
References: RFC 9990 §3.1.1.9, RFC 9990 §3.1.1.11.
Export raw authentication domains and results separately from policy-evaluated alignment and reported disposition. Add service ownership, confidence and analyst classification as explicitly derived fields. Document allowed values and missing-value semantics in a data dictionary.
A missing classification means unknown, not unauthorized. A missing result is not a pass or a fail unless the supported format and evaluation rule establish that meaning. Preserve original values where a normalized view is needed, and explain normalization without altering evidence invisibly.
Reproduce a small calculation
References: RFC 9989 §5.3.5, RFC 9990 §3.5.4.
Illustrative dataset: report A contains a count of 90 with aligned DKIM pass, and report B contains a count of 10 with both aligned mechanisms failing. A repeated byte-identical arrival of A is excluded under the recorded duplicate decision. The observed pass rate is 90 divided by 100, or 90 percent, not 180 divided by 190.
Save the two included source references, the excluded arrival reference, the query revision and the numerator and denominator. The decision is to investigate B's ten observations and establish their service ownership. Nothing in this synthetic example proves ten lost deliveries or ten malicious messages. The calculation can be reproduced while those interpretations remain unresolved.
Deliver a usable handoff
Package the export with its scope, field dictionary, transformation log, source manifest and known exceptions. Use access controls appropriate for operational identifiers and any personal information. Do not put unrestricted original attachments into a broadly shared spreadsheet merely to make provenance convenient.
Have another analyst reconstruct one result from the retained sources before relying on recurring exports. Date revisions when late reports or ownership corrections change the result. Preserve the earlier view and explain the difference. Close the handoff with the receiving analyst, permitted purpose, unresolved questions and next review trigger.
Continue the investigation
Use the aggregate-report walkthrough for the underlying fields and the alignment diagnosis guide when raw authentication success does not satisfy DMARC.
Bound the conclusion and next action
The supplied local arithmetic retains A’s 90 observations once and B’s 10 once: 90/100 = 90%. Counting A twice would produce 180/190 ≈ 94.7368%, a different and invalid duplicate-inflated view under this fixture’s stated rule. The exercise uses supplied identities and duplicate decisions; no export was shared, no actual attachment was ingested and no source authenticity was verified.