DMARC has been public since 2012 but most company domains still don't enforce it • Hacker News Board

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#41

Post by matharmin » Tue, Jul 28, 2026, 2:38 PM UTC

raluk wrote: post #33

I am running email server for my private domain using https://github.com/docker-mailserver/docker-mailserver . One day in 2023 i decided that beside of dkim i maybe should also enable dmarc. Because ... well, why not. What happened was that i started reciving regular reports over email from ms and google containing compressed xml containing no info other that empty report was generated. What should I do with that? At…

There are lots of free tools that automatically analyze the reports for you (you send it to them, instead of yourself).

But if you send all emails for your domain from one email server, you could just disable rua reporting. The reports are mainly useful to see whether you have some misconfigired email server somewhere that causes (or will cause) dropped emails. That can easily happen if you send some email from your own server, some via sendgrid, some via some marketing tool, and start to lose track of them. But for a personal email server, that's not common.

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#42

Post by newsoftheday » Tue, Jul 28, 2026, 2:48 PM UTC

bcrl wrote: post #28

Sadly the article doesn't really touch on whether or not DMARC accomplishes anything truly useful. When I enabled DMARC for ingress email on one of my own mail servers, it ultimately ended up regularly blocking a handful emails from customers, yet virtually all the spam coming in had valid SPF / DKIM / DMARC, as do most of the phishing attacks. The core problem is that the real need of email end users need is a way o…

My domain is very low traffic but, I just looked through my admin email account and opendmarc has rejected 18 attempts by spammers just this past week. More were rejected by my domain's DMARC policy.

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#43

Post by newsoftheday » Tue, Jul 28, 2026, 2:54 PM UTC

TheChaplain wrote: post #20

If you have any domains that does not use email, it may be a good idea to set up some DNS records to prevent it being used. DNS SPF record: mydomain.io. TXT "v=spf1 -all" DNS DMARC: _dmarc.mydomain.io. TXT "v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s" That ought to stop anyone trying to use your domains as source.

I use postfix and the recipient_access file to control email to my domains which use little email, so the domains are able to process standard email:

admin@example.com OK postmaster@example.com OK abuse@example.com OK webmaster@example.com OK hostmaster@example.com OK info@example.com OK example.com REJECT example.com

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#44

Post by OJFord » Tue, Jul 28, 2026, 2:59 PM UTC

datakan wrote: post #18

68.4% is actually a lot. Considering how badly abused email has always been, I'm actually surprised its nearly 70% and growing. Cup half full I guess

68.4% still don't enforce it, i.e. adoption is just over 30%, not nearly 70%.

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#45

Post by draygonia » Tue, Jul 28, 2026, 3:03 PM UTC

butterknife wrote: post #27

cube00 wrote: post #16

Earlier quoted context omitted.

It's ironic that I set everything up correctly on my self hosted domain and still end up in spam because of my low volume. I even go to the trouble of registering in their Postmaster Tools and clogging up my DNS with their verification tokens all for the tools to tell me I don't send enough mail while they happily pass what little mail I send straight to spam. Not enough outgoing email You haven't sent enough email t…

In the same boat here. At least still have a good standing at Microft. Lost goodwill at big G by what I vaguely narrowed down to self hosted images in e-mail signature.

Don't self-hosted images in the email signature allow you to track whether the email was opened or not and potentially where it was opened? I can only imagine they want you to pay for that privilege as a service.

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#46

Post by velcrovan » Tue, Jul 28, 2026, 3:06 PM UTC

EvanAnderson wrote: post #21

I mind email for a number of small orgs (<1000 recipients each). There are so many SPF and DKIM failures from senders who you'd think would know better (Fortune 100-type companies). I don't want complaints from users missing messages so I end up disregarding failures even when published policy says to do otherwise.

I take the opposite approach, I refuse to whitelist domains. When someone internal complains I send a notice to their contact on the other end (CCing the internal recipient) saying their email is misconfigured and ask them to put me in touch with their IT department to help them fix it. I use a script to do some DNS lookups and write the email for me. I have about a 50% success rate getting them to fix it.

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#47

Post by bornfreddy » Tue, Jul 28, 2026, 3:09 PM UTC

datakan wrote: post #18

68.4% is actually a lot. Considering how badly abused email has always been, I'm actually surprised its nearly 70% and growing. Cup half full I guess

You misunderstood, it's 31.6% actually.

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#48

Post by newsoftheday » Tue, Jul 28, 2026, 3:11 PM UTC

cube00 wrote: post #16

jwr wrote: post #9

I really think we should be solving a much bigger problem of the major email providers not providing an automated way of handling abuse and not caring about abuse reports at all. Most of my spam comes from the three major email providers and at this point I gave up even trying to send abuse reports because they just get ignored. The big companies do not have to care because nobody will block Google, Microsoft or Amaz…

It's ironic that I set everything up correctly on my self hosted domain and still end up in spam because of my low volume. I even go to the trouble of registering in their Postmaster Tools and clogging up my DNS with their verification tokens all for the tools to tell me I don't send enough mail while they happily pass what little mail I send straight to spam. Not enough outgoing email You haven't sent enough email t…

I just checked my email server's IP and it is still listed at https://substrate.office.com/ip-domain-management-snds/SNDS/...

And I can Remove or Renew Access, or those links are showing.

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#49

Post by teddyh » Tue, Jul 28, 2026, 3:11 PM UTC

TheChaplain wrote: post #20

If you have any domains that does not use email, it may be a good idea to set up some DNS records to prevent it being used. DNS SPF record: mydomain.io. TXT "v=spf1 -all" DNS DMARC: _dmarc.mydomain.io. TXT "v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s" That ought to stop anyone trying to use your domains as source.

Also consider (using your example domain):

  *.mydomain.io. TXT "v=spf1 -all"

to restrict SPF on all subdomains.

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#50

Post by at1as » Tue, Jul 28, 2026, 3:16 PM UTC

I’d be interested these stats broken down between domains associated with operating companies and personal or hobby domains.

The latter are likely to adopt much more slowly simply because of less perceived risk, lower payoff (no vendor reviews), and less dedicated technical expertise.

Just like personal sites were slow to adopt HTTPS. Mass HTTPS adoption happened once browser warnings and SEO incentives rendered sites mostly useless without it.