diff --git a/samples/aggregate/protection.outlook.com!example.com!1711756800!1711843200.xml b/samples/aggregate/protection.outlook.com!example.com!1711756800!1711843200.xml
new file mode 100644
index 00000000..ccb2e40f
--- /dev/null
+++ b/samples/aggregate/protection.outlook.com!example.com!1711756800!1711843200.xml
@@ -0,0 +1,45 @@
+<?xml version="1.0"?>
+<feedback xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+  <version>1.0</version>
+  <report_metadata>
+    <org_name>Outlook.com</org_name>
+    <email>dmarcreport@microsoft.com</email>
+    <report_id>cfeafefe4129445e8c81018bd9177197</report_id>
+    <date_range>
+      <begin>1711756800</begin>
+      <end>1711843200</end>
+    </date_range>
+  </report_metadata>
+  <policy_published>
+    <domain>example.com</domain>
+    <adkim>r</adkim>
+    <aspf>r</aspf>
+    <p>none</p>
+    <sp>none</sp>
+    <pct>100</pct>
+    <fo>0</fo>
+  </policy_published>
+  <record>
+    <row>
+      <source_ip>100.24.188.149</source_ip>
+      <count>1</count>
+      <policy_evaluated>
+        <disposition>none</disposition>
+        <dkim>fail</dkim>
+        <spf>fail</spf>
+      </policy_evaluated>
+    </row>
+    <identifiers>
+      <envelope_to>hotmail.com</envelope_to>
+      <envelope_from>example.com</envelope_from>
+      <header_from>example.com</header_from>
+    </identifiers>
+    <auth_results>
+      <spf>
+        <domain>example.com</domain>
+        <scope>mfrom</scope>
+        <result>fail</result>
+      </spf>
+    </auth_results>
+  </record>
+</feedback>