diff --git a/google_secops_parser/README.md b/google_secops_parser/README.md
index 6242cd27..92af8338 100644
--- a/google_secops_parser/README.md
+++ b/google_secops_parser/README.md
@@ -49,7 +49,7 @@ detects them by a field unique to each and maps them as follows:
 
 | parsedmarc report | Detected by | UDM `metadata.event_type` |
 | --- | --- | --- |
-| DMARC aggregate | `xml_schema` | `EMAIL_TRANSACTION` |
+| DMARC aggregate | `xml_schema` (the serialized marker of the `<feedback>` XML root) | `EMAIL_TRANSACTION` |
 | DMARC failure | `feedback_type` or `arrival_date_utc` | `EMAIL_TRANSACTION` |
 | SMTP TLS (RFC 8460) | `policy_type` or `result_type` | `GENERIC_EVENT` |
 
@@ -57,10 +57,15 @@ The `or` fallbacks matter: text-format failure reports have no `Feedback-Type`
 field (parsedmarc emits no `feedback_type` key for them, but always computes
 `arrival_date_utc`), and SMTP TLS failure-detail rows from parsedmarc versions
 older than this parser lack `policy_type` (every RFC 8460 failure detail has a
-`result_type`). `xml_schema` needs no fallback: the `<feedback>` XML root
-element is what identifies an aggregate report, and parsedmarc guarantees a
-non-empty `xml_schema` on every aggregate row ("draft" whenever `<version>`
-is missing, empty, or whitespace).
+`result_type`).
+
+`xml_schema` needs no fallback because it is not something the report
+supplies. What actually identifies an aggregate report is its `<feedback>`
+XML root element — but the raw XML never reaches SecOps: parsedmarc parses
+it and only the flattened JSON rows go over syslog. `xml_schema` is the
+field parsedmarc synthesizes on every row that came from a `<feedback>`
+document ("draft" whenever `<version>` is missing, empty, or whitespace), so
+testing it is one-to-one equivalent to testing for the `<feedback>` root.
 
 `EMAIL_TRANSACTION` and `GENERIC_EVENT` are both valid `metadata.event_type`
 values. Note that **`GENERIC_EVENT` events only appear in raw-log and UDM