DMARC has been public since 2012 but most company domains still don't enforce it
1–10 of 185 posts
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#2I am self-hosting my (secondary) email and have only implemented SPF and DKIM. This works fine on a practical level for me. What would be the benefit of setting up DMARC on top?
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#3I am self-hosting my (secondary) email and have only implemented SPF and DKIM. This works fine on a practical level for me. What would be the benefit of setting up DMARC on top?
Because if someone spoofs an email coming from your domain DMARC tells the receiver what to do with the spoofed email.
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#4The article speaks about DMARC monitoring, but not about "writing" it. So many orgs are too small to have someone paying attention of these things. Where I work, the CTO used to manage the DNS, but with very little understanding of what it all means. It was just copy and paste. And yes, it also says p=none. Probably because it was in the example. It's like setting up a website for your company, and picking some wordpress instance: how are you supposed to know the risks? It's just too much.
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#5I am self-hosting my (secondary) email and have only implemented SPF and DKIM. This works fine on a practical level for me. What would be the benefit of setting up DMARC on top?
Because if someone spoofs an email coming from your domain DMARC tells the receiver what to do with the spoofed email.
And what is the sane way to handle a spoofed email?
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#6I am self-hosting my (secondary) email and have only implemented SPF and DKIM. This works fine on a practical level for me. What would be the benefit of setting up DMARC on top?
Because if someone spoofs an email coming from your domain DMARC tells the receiver what to do with the spoofed email.
Google, Microsoft, Amazon and others send me summary reports of people spoofing my domains. I have dmarc set for them to accept the email, mark it spam (presumably) and send me a report. I really should and can tell them to reject the spam completely - another setting in dmarc but haven't yet out of laziness basically.
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#7I am self-hosting my (secondary) email and have only implemented SPF and DKIM. This works fine on a practical level for me. What would be the benefit of setting up DMARC on top?
Because if someone spoofs an email coming from your domain DMARC tells the receiver what to do with the spoofed email.
And SPF doesn't?
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#8Earlier quoted context omitted.
Because if someone spoofs an email coming from your domain DMARC tells the receiver what to do with the spoofed email.
And what is the sane way to handle a spoofed email?
That's what the policy setting tells the recipient. You can tell them to trest it as normal, send it to spam or delete it.
The report that they send you is useful for you to make sure your emails that you expect to go through are going through.
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#9I really think we should be solving a much bigger problem of the major email providers not providing an automated way of handling abuse and not caring about abuse reports at all. Most of my spam comes from the three major email providers and at this point I gave up even trying to send abuse reports because they just get ignored.
The big companies do not have to care because nobody will block Google, Microsoft or Amazon. They are too big to fail.
Spoofing a From field is an insignificant problem in comparison.
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#10Earlier quoted context omitted.
Because if someone spoofs an email coming from your domain DMARC tells the receiver what to do with the spoofed email.
And SPF doesn't?
Technically, no.
SPF allows to say “these IPs are authorised to send emails as example.com”, where DMARC allows to say “I as domain owner recommend to quarantine emails that fail SPF and DKIM”, it also allows finer alignment (ie, matching between different “from” parameters) configuration and reporting by the receivers.
Of course, with absence of DNARC policies, receivers default to some internal defaults, or may ignore the policies altogether. But at least, the big ones send DMARC reports.