diff --git a/.github/workflows/python-tests.yml b/.github/workflows/python-tests.yml
index 7667da9..828d365 100644
--- a/.github/workflows/python-tests.yml
+++ b/.github/workflows/python-tests.yml
@@ -60,7 +60,7 @@ jobs:
       run: |
         pip install -e .
         parsedmarc --debug -c ci.ini samples/aggregate/*
-        parsedmarc --debug -c ci.ini samples/forensic/*
+        parsedmarc --debug -c ci.ini samples/failure/*
     - name: Test building packages
       run: |
         hatch build
diff --git a/AGENTS.md b/AGENTS.md
index e07b108..b28edb2 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -24,7 +24,7 @@ ruff format .
 
 # Test CLI with sample reports
 parsedmarc --debug -c ci.ini samples/aggregate/*
-parsedmarc --debug -c ci.ini samples/forensic/*  # failure/forensic samples
+parsedmarc --debug -c ci.ini samples/failure/*
 
 # Build docs
 cd docs && make html
@@ -54,7 +54,7 @@ To skip DNS lookups during testing, set `GITHUB_ACTIONS=true`.
 
 ### DMARCbis support
 
-Aggregate reports support both RFC 7489 and DMARCbis (DMARC 2.0) formats. DMARCbis adds fields: `np` (non-existent subdomain policy), `testing` (replaces `pct`), `discovery_method` (`psl`/`treewalk`), `generator` (report metadata), and `human_result` (DKIM/SPF auth results). `pct` and `fo` default to `None` when absent (DMARCbis drops these). XML with namespace `urn:ietf:params:xml:ns:dmarc-2.0` is handled automatically.
+Aggregate reports support both RFC 7489 and DMARCbis formats. DMARCbis adds fields: `np` (non-existent subdomain policy), `testing` (replaces `pct`), `discovery_method` (`psl`/`treewalk`), `generator` (report metadata), and `human_result` (DKIM/SPF auth results). `pct` and `fo` default to `None` when absent (DMARCbis drops these). Namespaced XML is handled automatically.
 
 ### Caching
 
diff --git a/docs/source/output.md b/docs/source/output.md
index c059806..63efd27 100644
--- a/docs/source/output.md
+++ b/docs/source/output.md
@@ -99,7 +99,7 @@ draft,acme.com,noreply-dmarc-support@acme.com,http://acme.com/dmarc/support,9391
 ## Sample failure report output
 
 Thanks to GitHub user [xennn](https://github.com/xennn) for the anonymized
-[failure report email sample](<https://github.com/domainaware/parsedmarc/raw/master/samples/forensic/DMARC%20Failure%20Report%20for%20domain.de%20(mail-from%3Dsharepoint%40domain.de%2C%20ip%3D10.10.10.10).eml>).
+[failure report email sample](<https://github.com/domainaware/parsedmarc/raw/master/samples/failure/DMARC%20Failure%20Report%20for%20domain.de%20(mail-from%3Dsharepoint%40domain.de%2C%20ip%3D10.10.10.10).eml>).
 
 ### JSON failure report
 
diff --git a/samples/forensic/DMARC Failure Report for domain.de (mail-from=sharepoint@domain.de, ip=10.10.10.10).eml b/samples/failure/DMARC Failure Report for domain.de (mail-from=sharepoint@domain.de, ip=10.10.10.10).eml
similarity index 100%
rename from samples/forensic/DMARC Failure Report for domain.de (mail-from=sharepoint@domain.de, ip=10.10.10.10).eml
rename to samples/failure/DMARC Failure Report for domain.de (mail-from=sharepoint@domain.de, ip=10.10.10.10).eml
diff --git a/samples/forensic/[Netease DMARC Failure Report] Rent Reminder.eml b/samples/failure/[Netease DMARC Failure Report] Rent Reminder.eml
similarity index 100%
rename from samples/forensic/[Netease DMARC Failure Report] Rent Reminder.eml
rename to samples/failure/[Netease DMARC Failure Report] Rent Reminder.eml
diff --git a/samples/forensic/dmarc_ruf_report_linkedin.crlf.eml b/samples/failure/dmarc_ruf_report_linkedin.crlf.eml
similarity index 100%
rename from samples/forensic/dmarc_ruf_report_linkedin.crlf.eml
rename to samples/failure/dmarc_ruf_report_linkedin.crlf.eml
diff --git a/samples/forensic/dmarc_ruf_report_linkedin.eml b/samples/failure/dmarc_ruf_report_linkedin.eml
similarity index 100%
rename from samples/forensic/dmarc_ruf_report_linkedin.eml
rename to samples/failure/dmarc_ruf_report_linkedin.eml
diff --git a/tests.py b/tests.py
index 58304ac..93bceaf 100755
--- a/tests.py
+++ b/tests.py
@@ -135,7 +135,7 @@ class Test(unittest.TestCase):
     def testForensicSamples(self):
         """Test sample failure/ruf DMARC reports"""
         print()
-        sample_paths = glob("samples/forensic/*.eml")
+        sample_paths = glob("samples/failure/*.eml")
         for sample_path in sample_paths:
             print("Testing {0}: ".format(sample_path), end="")
             with self.subTest(sample=sample_path):
@@ -1634,7 +1634,7 @@ class Test(unittest.TestCase):
     def testFailureReportCsvRoundtrip(self):
         """Failure report CSV generation works on sample reports"""
         print()
-        sample_paths = glob("samples/forensic/*.eml")
+        sample_paths = glob("samples/failure/*.eml")
         for sample_path in sample_paths:
             print("Testing CSV for {0}: ".format(sample_path), end="")
             with self.subTest(sample=sample_path):