1. Legitimate sender: configuration fix
Folder: 01-legitimate-sender-fix
Fictional inventory: 192.0.2.10 is an authorised transactional sender for
sender.example. Before the fix, SPF and DKIM both fail. The fictional operator
then authorises the envelope sender and enables aligned DKIM signing.
Both batches contain 1,000 messages from Receiver A (synthetic).
Baseline: 1,000 failed, 100% failure. Comparison: 0 failed, 0% failure.
192.0.2.10: Failure rate decreased, -100 percentage points. No coverage cautions.
Both aligned mechanisms pass after the change, but DMARC only needs one.
Interpretation: the observations are consistent with the stated fix. Confirm
real changes using provider configuration and representative message headers;
the XML does not independently verify the operator's actions or delivery.

2. Unexpected source in the later period
Folder: 02-unexpected-source
Fictional inventory: only 192.0.2.10 is expected.
Baseline: 1,000 messages, 0 failed, 0% failure.
Comparison: 1,100 messages, 100 failed, 9.0909...% failure (UI may round).
192.0.2.10: 1,000 passing messages in each batch, Unchanged, 0 percentage points.
198.51.100.77: 0 before, 100 after, all failing, New in comparison.
Its rate delta is undefined (shown as an em dash), not a 100-point increase:
there was no baseline volume for this source. No coverage cautions.
Interpretation: investigate the new observation against inventory and message
headers. It could be an unrecorded legitimate service, forwarding or abuse.
Do not label it an attacker or add it to SPF solely because it is present.

3. Misleading apparent improvements from coverage changes
3a folder: 03a-missing-reporter
Baseline: Receiver A reports 900 passing messages; Receiver B reports 100
failures, all for 192.0.2.10. Total 1,000, failed 100, failure rate 10%.
Comparison: only Receiver A, 900 passing messages. Failed 0, failure rate 0%.
Source: Failure rate decreased, -10 percentage points.
Cautions: receiver/domain coverage differs; receiver reporting-window coverage
differs. Overall batch time spans remain equal; there is no time-span caution.
Interpretation: Receiver B's later report is missing. Receiver A's result has
not improved. The overall drop cannot establish that the sender was fixed.

3b folder: 03b-shortened-period
Baseline: Receiver A reports a full day, 900 passing messages and 100 failures
for 192.0.2.10. Total 1,000, failure rate 10%.
Comparison: same receiver, first 12 hours only, 450 passing messages, 0 failures.
Source: Failure rate decreased, -10 percentage points.
Cautions: receiver reporting-window coverage differs; batch time spans differ.
No receiver/domain population caution: the reporting organisation is unchanged.
Fictional background: the failing workload runs in the afternoon. The aggregate
XML has no per-message times and does not itself prove this schedule.
Interpretation: the comparison omits the hours in which the fictional failures
occur. Even failure rates can mislead with unequal coverage. Obtain the missing
period and compare equivalent receiver populations and complete UTC windows
before attributing an improvement to a configuration change.
