[flagged]
DMARC has been public since 2012 but most company domains still don't enforce it
11–20 of 185 posts
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#12I'll set up DMARC after I get DKIM working... migrating my homelab has been taking forever...
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#13Earlier quoted context omitted.
Because if someone spoofs an email coming from your domain DMARC tells the receiver what to do with the spoofed email.
And SPF doesn't?
Not always. An email has a valid SPF when its return path email’s domain permits the sending server’s IP. But that email may have a forged From: header (which causes an SPF mis-alignment), and the receiving server checks the DMARC of *the From header* domain to determine how to handle that mis-alignment.
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#14I am self-hosting my (secondary) email and have only implemented SPF and DKIM. This works fine on a practical level for me. What would be the benefit of setting up DMARC on top?
The biggest benefit I saw in a small domain was greatly reduced backscatter spam. Before someone’d randomly make up a billion emails on my domain and send “from” them, and I’d get various out of office replies, etc (catch all) - that basically never happens anymore.
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#15Email has been turned into a by-the-corporation, for-the-corporation service. Corporations need DMARC so they can control email and the ability to spam. The spam I cannot block is spam from Google.
If you decide to think about this, you will quickly realize that email is f*ked and needs to be forked. Perhaps we need a Community Email Initiative that blocks corporations and only allows Community members.
Trust is the one thing you can't buy on the Corporate Internet.
I am sure many people will be offended and down vote this comment because they cannot conceptualize an internet without Corporations.
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#16I really think we should be solving a much bigger problem of the major email providers not providing an automated way of handling abuse and not caring about abuse reports at all. Most of my spam comes from the three major email providers and at this point I gave up even trying to send abuse reports because they just get ignored. The big companies do not have to care because nobody will block Google, Microsoft or Amaz…
It's ironic that I set everything up correctly on my self hosted domain and still end up in spam because of my low volume.
I even go to the trouble of registering in their Postmaster Tools and clogging up my DNS with their verification tokens all for the tools to tell me I don't send enough mail while they happily pass what little mail I send straight to spam.
Not enough outgoing email
You haven't sent enough email to personal Gmail (@gmail.com) accounts to determine deliverability status for your domain and messages.
Guess it doesn't help that as I look today the Postmaster Tools dashboard shows "Last updated Sun, Apr 26, at 9:30 AM."
Then on the other hand Google can flood me with spam filled Google Calendar Invites and Google Drive Share notifications, all fully DKIM signed because they are coming out of those services, all day long.
Microsoft have also recently changed their Smart Network Data Service (SNDS) so now only my cloud provider can access the console as they only allow verification to the owner of the whole ASN block you're under. I can't access detail about my domain anymore, and still my mail goes to junk. Unless you own a chunk of IPv4 ASN range you're out of luck. IPv6? Nope, not at Microsoft. "Please note that IPv6 is not currently supported." [1]
[1]: https://substrate.office.com/ip-domain-management-snds/SNDS/...
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#17Article is missing a note on the existence of MX records for the domains. Sure, you can easily have a send-only domain without an MX record, but the common case is likely to setup both send and receive capability. It would be interesting to have that number included as domains without MX and DMARC might just not be configured for email at all. Worst case the 45% of domains without DMARC are simply not relevant for email and thus not configured at all. I would find "x% of domains with configured email don't enforce DMARC" more interesting.
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#1868.4% is actually a lot. Considering how badly abused email has always been, I'm actually surprised its nearly 70% and growing. Cup half full I guess
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#19Email has been turned into a by-the-corporation, for-the-corporation service. Corporations need DMARC so they can control email and the ability to spam. The spam I cannot block is spam from Google. If you decide to think about this, you will quickly realize that email is f*ked and needs to be forked. Perhaps we need a Community Email Initiative that blocks corporations and only allows Community members. Trust is the…
You can do this right now, and you don't even need to fork anything. E-mail is an internet scale protocol that's not owned or ownable, except by convention. Since you specifically want to cut out Google, and their attempts to capture E-mail are what makes rolling your own E-mail hard anyway, just go for it.
Depending on how hard you want to make it, you can slap all the parts together yourself or use something like Zimbra, Mailcow, iRedMail, mail-in-a-box.
The advantage over a fork, whatever specifically that means, is any service that needs E-mail as an identity verification, still works.
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#20If you have any domains that does not use email, it may be a good idea to set up some DNS records to prevent it being used.
DNS SPF record: mydomain.io. TXT "v=spf1 -all"
DNS DMARC: _dmarc.mydomain.io. TXT "v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s"
That ought to stop anyone trying to use your domains as source.