It looks like each of these reports will parse the "empty" auth_results element as a string rather than a list of empty fields.
In theory these are invalid reports as per the RFC there should always be at least a spf element.
<xs:complexType name="SPFAuthResultType">
<xs:all>
<!-- The checked domain. -->
<xs:element name="domain" type="xs:string" minOccurs="1"/>
<!-- The scope of the checked domain. -->
<xs:element name="scope" type="SPFDomainScope" minOccurs="1"/>
<!-- The SPF verification result. -->
<xs:element name="result" type="SPFResultType"
minOccurs="1"/>
</xs:all>
</xs:complexType>
<!-- This element contains DKIM and SPF results, uninterpreted
with respect to DMARC. -->
<xs:complexType name="AuthResultType">
<xs:sequence>
<!-- There may be no DKIM signatures, or multiple DKIM
signatures. -->
<xs:element name="dkim" type="DKIMAuthResultType"
minOccurs="0" maxOccurs="unbounded"/>
<!-- There will always be at least one SPF result. -->
<xs:element name="spf" type="SPFAuthResultType" minOccurs="1"
maxOccurs="unbounded"/>
</xs:sequence>
</xs:complexType>
<!-- This element contains all the authentication results that
were evaluated by the receiving system for the given set of
messages. -->
<xs:complexType name="RecordType">
<xs:sequence>
<xs:element name="row" type="RowType"/>
<xs:element name="identifiers" type="IdentifierType"/>
<xs:element name="auth_results" type="AuthResultType"/>
</xs:sequence>
</xs:complexType>
Related: I suspect that something is broken with running the unit tests in my local environment because these all pass (which suggests that this is fixed upstream and I'm somehow using that version rather than my forked version).
The following error is throw in the unit tests.
https://github.com/nhairs/parsedmarc-fork/blob/c37573fa60adc0ea35da4d1e6d0c36b02c2ea1fb/src/parsedmarc/parser.py#L490
Example XML snippet:
The following samples contain this:
samples/aggregate/usssa.com!example.com!1538784000!1538870399.xml
samples/aggregate/estadocuenta1.infonacot.gob.mx!example.com!1536853302!1536939702!2940.xml.zip
samples/aggregate/example.net!example.com!1529366400!1529452799.xml
It looks like each of these reports will parse the "empty"
auth_results
element as a string rather than a list of empty fields.In theory these are invalid reports as per the RFC there should always be at least a
spf
element.Related: I suspect that something is broken with running the unit tests in my local environment because these all pass (which suggests that this is fixed upstream and I'm somehow using that version rather than my forked version).