68.4% is actually a lot. Considering how badly abused email has always been, I'm actually surprised its nearly 70% and growing. Cup half full I guess
68.4% still don't enforce it , i.e. adoption is just over 30%, not nearly 70%.
Thank you
DMARC has been public since 2012 but most company domains still don't enforce it
61–70 of 185 posts
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#62Re: DMARC has been public since 2012 but most company domains still don't enforce it
#63Sadly the article doesn't really touch on whether or not DMARC accomplishes anything truly useful. When I enabled DMARC for ingress email on one of my own mail servers, it ultimately ended up regularly blocking a handful emails from customers, yet virtually all the spam coming in had valid SPF / DKIM / DMARC, as do most of the phishing attacks. The core problem is that the real need of email end users need is a way o…
The primary purpose of DMARC is to prevent impersonation not to prevent spam. I own a domain, I implement DMARC to make sure others know when email from my domain is legitimately from my domain.
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#64[dead]
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#65I’d be interested these stats broken down between domains associated with operating companies and personal or hobby domains. The latter are likely to adopt much more slowly simply because of less perceived risk, lower payoff (no vendor reviews), and less dedicated technical expertise. Just like personal sites were slow to adopt HTTPS. Mass HTTPS adoption happened once browser warnings and SEO incentives rendered site…
I'd expect the opposite really. Personal domains sending email are more likely to be run by MTA enthusiasts who don't have any money riding on others being able to receive their mails compared to corporate IT where mail is just one more thing they have to wrangle and really don't need the company leadership being angry at them because the spam-as-a-service company that marketing has been using without telling anyone gets blocked due to their DNS settings.
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#66I really think we should be solving a much bigger problem of the major email providers not providing an automated way of handling abuse and not caring about abuse reports at all. Most of my spam comes from the three major email providers and at this point I gave up even trying to send abuse reports because they just get ignored. The big companies do not have to care because nobody will block Google, Microsoft or Amaz…
Agreed, most spam has valid DMARC - whether that's bigmail.com or just nobodcarestoprotectsubdomains.randompwnedcompany.com
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#67Sadly the article doesn't really touch on whether or not DMARC accomplishes anything truly useful. When I enabled DMARC for ingress email on one of my own mail servers, it ultimately ended up regularly blocking a handful emails from customers, yet virtually all the spam coming in had valid SPF / DKIM / DMARC, as do most of the phishing attacks. The core problem is that the real need of email end users need is a way o…
My work email is Outlook, which is horribly broken and terrible to use. I have a rule configured to "re-send" all my mail to a different account where I read it with a usable MUA. Unfortunately this seems to break DMARC for external mail as now an email from e.g. user@example.com appears to have been sent by outlook.com.
I'm not familiar with Outlook's resending, but the use case is supported if the sender uses DKIM. If the email is forwarded without changing any details, it can keep the DKIM signature. That allows the forwarded email to still pass DMARC.
Now if the sender used SPF + DMARC but not DKIM, this does not work, since the sender IP can't be verified with the forwarded email. In that case, the forwarder has to change the from address to prevent the email from failing DMARC and be rejected.
In practice, senders using SPF+DMARC but not DKIM should be quite rare, you see DKIM+DMARC much more often.
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#68Earlier quoted context omitted.
In the same boat here. At least still have a good standing at Microft. Lost goodwill at big G by what I vaguely narrowed down to self hosted images in e-mail signature.
Don't self-hosted images in the email signature allow you to track whether the email was opened or not and potentially where it was opened? I can only imagine they want you to pay for that privilege as a service.
Gmail already proxies embedded images so you'd only be able to track when an email was opened the first time. Anyway, I have been sending (very low volume) of mails with self-hosted images embedded in the body for years without problems with Gmail but Microsoft doesn't like my VPS IP because sometimes there are temporarly bad actors on the same block. So I guess it's mostly random luck.
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#69Email has been turned into a by-the-corporation, for-the-corporation service. Corporations need DMARC so they can control email and the ability to spam. The spam I cannot block is spam from Google. If you decide to think about this, you will quickly realize that email is f*ked and needs to be forked. Perhaps we need a Community Email Initiative that blocks corporations and only allows Community members. Trust is the…
You can already do this without changing anything. Just set your corporate mailserver to not accept mail from common community email providers. There's a reason nobody does this, and it's because it's a bad idea. There is so much crossover between personal email and corporate email.
My previous employer did this, and no one seemed to miss it. If you had a use case to add an exception (the most common was to send yourself a mail from your personal Gmail, to print something on the corporate printers) that was supported and straightforward too.
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#70[flagged]