The dates that you can see in Aggregate Reports in DMARC Analytics are not the dates when you sent the messages from your email service provider. Those are the dates when DMARC reports were formed for already sent and received by recipients messages.
During the day, mailbox providers are receiving the messages and adding the data (SPF, DKIM, DMARC, IP address) about each received message to its internal database.
Aggregate DMARC reports are created every day starting from 00:00:00 UTC till 23:59:59 UTC and can be sent to the email sender with a delay from a few to 20+ hours as mailbox providers receive a huge number of email messages every day and don’t always cope with that volume on time. With that said, if you sent a message today, you may receive a DMARC report in 1,5 – 2 days.
DMARC reports have the <date range> data where the time frame when the report was formed is encoded.
Example with the decoded dates and times:
<begin>1616367603</begin> : Sun Mar 21 2021 23:00:03 GMT+0000
<end>1616454003</end>: Mon Mar 22 2021 23:00:03 GMT+0000
GlockApps uses the date from the <end> </end> tag to determine what date sent messages should be associated with. But GlockApps doesn’t know the actual date when you sent the message. It looks at the end date in the report that shows only the end time of the report creation, but not the real date and time of the message sending.
If in GlockApps Aggregate Reports, you see that the number of emails for this or that day is different (lower) than the real number of emails that you sent that day, it can mean that DMARC reports were created the next day after sending and our tool added those messages to the data for the next day.