I mind email for a number of small orgs (<1000 recipients each). There are so many SPF and DKIM failures from senders who you'd think would know better (Fortune 100-type companies). I don't want complaints from users missing messages so I end up disregarding failures even when published policy says to do otherwise.
DMARC has been public since 2012 but most company domains still don't enforce it
21–30 of 185 posts
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#22Using DMARC information is complicated in practice in the real world, by Chris Siebenmann
https://utcc.utoronto.ca/~cks/space/blog/spam/DMARCPractical...
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#23Email has been turned into a by-the-corporation, for-the-corporation service. Corporations need DMARC so they can control email and the ability to spam. The spam I cannot block is spam from Google. If you decide to think about this, you will quickly realize that email is f*ked and needs to be forked. Perhaps we need a Community Email Initiative that blocks corporations and only allows Community members. Trust is the…
What do you mean “fork”? Just buy a domain and install an email server.
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#24I am self-hosting my (secondary) email and have only implemented SPF and DKIM. This works fine on a practical level for me. What would be the benefit of setting up DMARC on top?
> What would be the benefit of setting up DMARC on top?
Some mail providers will junk your mail if you don't have a reject/quarantine DMARC policy because you're seen as enabling the spammers so everything out of your domain must be punished.
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#25[dead]
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#26[flagged]
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#27I really think we should be solving a much bigger problem of the major email providers not providing an automated way of handling abuse and not caring about abuse reports at all. Most of my spam comes from the three major email providers and at this point I gave up even trying to send abuse reports because they just get ignored. The big companies do not have to care because nobody will block Google, Microsoft or Amaz…
It's ironic that I set everything up correctly on my self hosted domain and still end up in spam because of my low volume. I even go to the trouble of registering in their Postmaster Tools and clogging up my DNS with their verification tokens all for the tools to tell me I don't send enough mail while they happily pass what little mail I send straight to spam. Not enough outgoing email You haven't sent enough email t…
In the same boat here. At least still have a good standing at Microft. Lost goodwill at big G by what I vaguely narrowed down to self hosted images in e-mail signature.
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#28Sadly the article doesn't really touch on whether or not DMARC accomplishes anything truly useful. When I enabled DMARC for ingress email on one of my own mail servers, it ultimately ended up regularly blocking a handful emails from customers, yet virtually all the spam coming in had valid SPF / DKIM / DMARC, as do most of the phishing attacks.
The core problem is that the real need of email end users need is a way of determining whether or not to trust a given sender. Signatures are purely a technical measure which provides no information on the trustworthiness of the sender. The end result is that email scoring still has to be content based, and the signature check technologies are pure noise with no useful signal for the purpose of determining if an email should actually show up in my inbox.
The tech industry has a bad habit of providing solutions to problems adjacent to problems the user actually needs solved while leaving the user's actual problem unresolved.
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#29Earlier quoted context omitted.
Because if someone spoofs an email coming from your domain DMARC tells the receiver what to do with the spoofed email.
And what is the sane way to handle a spoofed email?
Realistically spoofed address (unauthenticated email) will be treated as spam and it’ll be implicitly quarantined or rejected as such by many well-known mail receivers. You can make this an explicit “reject” by publishing DMARC policy for your domain.
For example, gmail.com treats unauthenticated email as spam implicitly, regardless of DMARC policy.
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#30DMARC, just like SPF before it, solves nothing. The spammers adapt. And unlike SPF, DMARC has an enormous technology surface area. Its failure modes are legion, and each one is tedious to run down to resolution. Which just returns you to something which never pays the rent anyway.