Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DMARC has been public since 2012 but most company domains still don't enforce it

ciphercue.com

Post reply on HN
Print view View original

71–80 of 185 posts

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#71

Post by account42 »

rft wrote: post #17

Article is missing a note on the existence of MX records for the domains. Sure, you can easily have a send-only domain without an MX record, but the common case is likely to setup both send and receive capability. It would be interesting to have that number included as domains without MX and DMARC might just not be configured for email at all. Worst case the 45% of domains without DMARC are simply not relevant for em…

Technically you can receive mail without MX records if your mail server is on the same host as the web server.

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#72

Post by account42 »

cube00 wrote: post #24
smartmic wrote: post #2

I am self-hosting my (secondary) email and have only implemented SPF and DKIM. This works fine on a practical level for me. What would be the benefit of setting up DMARC on top?

> What would be the benefit of setting up DMARC on top? Some mail providers will junk your mail if you don't have a reject/quarantine DMARC policy because you're seen as enabling the spammers so everything out of your domain must be punished.

[citation needed]

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#73

Post by egorfine »

bcrl wrote: post #28

Sadly the article doesn't really touch on whether or not DMARC accomplishes anything truly useful. When I enabled DMARC for ingress email on one of my own mail servers, it ultimately ended up regularly blocking a handful emails from customers, yet virtually all the spam coming in had valid SPF / DKIM / DMARC, as do most of the phishing attacks. The core problem is that the real need of email end users need is a way o…

> The tech industry has a bad habit of providing solutions to problems adjacent to problems the user actually needs solved while leaving the user's actual problem unresolved.

Extremely well said.

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#74

Post by tgv »

infogulch wrote: post #38
tgv wrote: post #4

The article speaks about DMARC monitoring, but not about "writing" it. So many orgs are too small to have someone paying attention of these things. Where I work, the CTO used to manage the DNS, but with very little understanding of what it all means. It was just copy and paste. And yes, it also says p=none. Probably because it was in the example. It's like setting up a website for your company, and picking some wordp…

LLMs are very good at helping you manage DMARC/DNS related configuration, even as a non-expert. I used it to develop custom DMARC report processing app that: 1. sucks in reports sent to our dmarc inbox into a sqlite db, 2. displays the results in a web page. The reports queue up in the mailbox and I open and start the app once a month to check the status. The agent also also reviewed the state of email-related DNS re…

Sounds nice, but it adds to the load. Small businesses consider their direct customers much more important, and have little time for this kind of thing. Managing a domain is more work than godaddy makes you believe...

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#75

Post by drdexebtjl »

velcrovan wrote: post #46
EvanAnderson wrote: post #21

I mind email for a number of small orgs (<1000 recipients each). There are so many SPF and DKIM failures from senders who you'd think would know better (Fortune 100-type companies). I don't want complaints from users missing messages so I end up disregarding failures even when published policy says to do otherwise.

I take the opposite approach, I refuse to whitelist domains. When someone internal complains I send a notice to their contact on the other end (CCing the internal recipient) saying their email is misconfigured and ask them to put me in touch with their IT department to help them fix it. I use a script to do some DNS lookups and write the email for me. I have about a 50% success rate getting them to fix it.

I have also done this, but instead by finding someone from IT or security on LinkedIn and messaging them there.

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#76

Post by agotterer »

I didn't see it explicitly mentioned in the post, I wonder if they filtered exclusively for domains with mx records. Because I would assume that lots of domains just don't have email configured and therefore aren't aware that you should still setup DMARC to prevent impersination of your domain.

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#77

Post by bigbuppo »

brightball wrote: post #58
bcrl wrote: post #28

Sadly the article doesn't really touch on whether or not DMARC accomplishes anything truly useful. When I enabled DMARC for ingress email on one of my own mail servers, it ultimately ended up regularly blocking a handful emails from customers, yet virtually all the spam coming in had valid SPF / DKIM / DMARC, as do most of the phishing attacks. The core problem is that the real need of email end users need is a way o…

> virtually all the spam coming in had valid SPF / DKIM / DMARC, as do most of the phishing attacks. This should create a means to go after the domain owners via registrar and trail of ownership, even so far as blocking email from the domain. Forcing the spammers to pass DMARC creates a burden and an evidence trail that didn't exist before.

They're generally hosted on a google or microsoft 365 or something slightly less shady. Good luck with that.

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#78

Post by HenriTEL »

thedougd wrote: post #63
bcrl wrote: post #28

Sadly the article doesn't really touch on whether or not DMARC accomplishes anything truly useful. When I enabled DMARC for ingress email on one of my own mail servers, it ultimately ended up regularly blocking a handful emails from customers, yet virtually all the spam coming in had valid SPF / DKIM / DMARC, as do most of the phishing attacks. The core problem is that the real need of email end users need is a way o…

The primary purpose of DMARC is to prevent impersonation not to prevent spam. I own a domain, I implement DMARC to make sure others know when email from my domain is legitimately from my domain.

Isn't that the purpose of DKIM and SPF already?

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#79

Post by Polizeiposaune »

matharmin wrote: post #67
SoftTalker wrote: post #53

Earlier quoted context omitted.

My work email is Outlook, which is horribly broken and terrible to use. I have a rule configured to "re-send" all my mail to a different account where I read it with a usable MUA. Unfortunately this seems to break DMARC for external mail as now an email from e.g. user@example.com appears to have been sent by outlook.com.

I'm not familiar with Outlook's resending, but the use case is supported if the sender uses DKIM. If the email is forwarded without changing any details, it can keep the DKIM signature. That allows the forwarded email to still pass DMARC. Now if the sender used SPF + DMARC but not DKIM, this does not work, since the sender IP can't be verified with the forwarded email. In that case, the forwarder has to change the fr…

I have a long-standing email address that forwards to an email system that I run. The operator of the forwarder switched to using Microsoft's mail infrastructure some years ago and the quality of service of the forward has degraded dramatically ever since.

I've often seen messages resent by Microsoft's mail infrastructure with gratuitously broken DKIM signatures, generally due to changes to whitespace that are not anticipated by DKIM's message canonicalization.

I've also seen messages sent by my bank directly to the email system I administer that had broken DKIM signatures apparently due to some sort of antivirus software they had downstream of the DKIM signer.

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#80

Post by warkdarrior »

HenriTEL wrote: post #78
thedougd wrote: post #63

Earlier quoted context omitted.

The primary purpose of DMARC is to prevent impersonation not to prevent spam. I own a domain, I implement DMARC to make sure others know when email from my domain is legitimately from my domain.

Isn't that the purpose of DKIM and SPF already?

ELI5: https://www.reddit.com/r/sysadmin/comments/16gvtdj/comment/k...
Post reply on HN