Repository navigation
DNS and Report Correlation
Navigation guide, not a versioned contract. This page tracks
dmarcgov3. The linked repository guides and Go documentation define behavior.
Operators reviewing sender onboarding, configuration drift, or differences between declared intent, current authentication DNS, and historical receiver observations.
Which observed streams map unambiguously to declared expected senders, and where does the completed evidence show aligned, failing, unknown, or changed behavior?
A normalized Portfolio, a completed DNSHealthResult, a completed
ReportEvidenceResult, explicit thresholds, and optionally one caller-selected
prior correlation result.
CorrelateReportEvidence is pure. It performs no DNS, parsing, enrichment,
filesystem access, history discovery, storage, retries, or clock lookup.
- Complete the portfolio/DNS workflow.
- Complete report-evidence analysis.
- Call
CorrelateReportEvidencewith explicit options. - Serialize with
WriteDNSReportCorrelationOutputif required.
Stream classifications, inventory evidence, thresholds, temporal context, stable findings, and optional caller-directed drift comparisons.
Current DNS cannot be claimed as the cause of older report outcomes. An unknown authentication failure is reviewable evidence, not malicious attribution. Provider recognition never authorizes or suppresses a source.
Correlation can combine internal sender inventory with observed domains, selectors, reporter identities, and source IPs. Select output redaction for the recipient and retain raw operational results only inside the intended boundary.
Review configuration findings before treating a stream as unexplained. Apply explicit message, report, reporter, duration, and recency thresholds, and keep below-threshold streams visible as not evaluated.
This wiki is a navigation layer for the current dmarcgo v3 line. Repository documentation is authoritative.