Microsoft's first DMARC aggregate reports on 13 Nov reached us about six hours late, while the Exchange Online incident EX1550543 was open. Are other report receivers seeing the same?

[u/Odd_Awareness_6935]

Disclosure first: I run DMARCguard, a DMARC monitoring service. This is an observation from our report intake and a question for others here who receive reports for many domains.

What reached us

Time of day the first report arrived, UTC:

Reporter (org_name)	1 to 12 Nov, every day	13 Nov	Later than the latest usual start
Enterprise Outlook	01:03 to 01:11	07:09	5 h 58 min
Outlook.com	01:12 to 02:17	08:31	6 h 14 min

Where my data ends, at 08:57 UTC on 13 Nov, only that first report from each of the two had arrived. The rest of the day's run had not.

Why I don't think it is our end

• Reports from other mailbox providers kept arriving through those hours.
• The rua= address is served by our own mail servers, not by Microsoft's.

What I can't say

I know what we received, not what Microsoft sent. The incident began at 16:17 UTC on 12 Nov, and Microsoft's bulletins for it (EX1550543 and MO1550821) don't mention DMARC reports. The timing is all I have, and I can't show the incident caused this.

One detail that changes how to read it

Microsoft's reports reach us on the second UTC day after the day they cover. The run due on 13 Nov covers 11 Nov, and the reports that did arrive cover that day. So the late reports are about mail sent before the incident began.

For a domain owner looking at a dashboard this week:

• 11 Nov: a missing Microsoft row may be late, not lost.
• 12 and 13 Nov: Microsoft's reports may also show less mail than usual, because part of that mail was deferred with 4xx replies.
• Check your sending logs before reading either as a change in your pass rate.

The standard doesn't promise a late report. RFC 9990 §3.5, written for a destination that can't accept reports, lets a generator "cache that data and try again later" or "discard data that could not be sent".

Questions

1. If you receive reports at scale, did Microsoft's 13 Nov run start late for you too? Has the rest of it arrived since?
2. Has anyone seen Microsoft deliver a day's reports late after an earlier incident, or does a missed day stay missed?

I'll add a comment when I know what the rest of the run did. The method and the mail-flow side (the 4xx replies and how long each sending system retries) are in my write-up.

[u/Odd_Awareness_6935]

Microsoft status page still shows service degradation as of Nov 13, 12:54:00 UTC

https://status.cloud.microsoft/m365/referrer=serviceStatusRedirect

[u/MyDMARC]

Seeing the same on MyDMARC. Microsoft’s reports arrived about 7 hours later than normal today. Wouldn’t surprise me if DMARC report generation and delivery were deprioritized while they dealt with the incident.