DMARC Has Been Public Since 2012. 68.4% of Domains Still Don't Enforce It
Fourteen years after DMARC launched, we found that 68.4% of company domains still lack enforcement. While many have records, most sit in a monitoring-only mode called p=none. The real barrier isn't ignorance but the overwhelming difficulty of parsing fragmented aggregate reports to identify legitimate senders, turning a simple configuration change into an endless research task.
An administrator staring at a week of these reports is not looking at a vendor list. They are looking at a pile of IP addresses and sender strings with no obvious owner, and deciding whether to enforce means identifying every one of them first.
- bcrl
Sadly the article doesn't really touch on whether or not DMARC accomplishes anything truly useful. When I enabled DMARC for ingress email on one of my own mail servers, it ultimately ended up regularly blocking a handful emails from customers, yet virtually all the spam coming in had valid SPF / DKIM / DMARC, as do most of the phishing attacks.
The core problem is that the real need of email end users need is a way of determining whether or not to trust a given sender. Signatures are purely a technical measure which provides no information on the trustworthiness of the sender. The end result is that email scoring still has to be content based, and the signature check technologies are pure noise with no useful signal for the purpose of determining if an email should actually show up in my inbox.
The tech industry has a bad habit of providing solutions to problems adjacent to problems the user actually needs solved while leaving the user's actual problem unresolved.
- EvanAnderson
I mind email for a number of small orgs (<1000 recipients each). There are so many SPF and DKIM failures from senders who you'd think would know better (Fortune 100-type companies). I don't want complaints from users missing messages so I end up disregarding failures even when published policy says to do otherwise.
- TheChaplain
If you have any domains that does not use email, it may be a good idea to set up some DNS records to prevent it being used.
DNS SPF record: mydomain.io. TXT "v=spf1 -all"
DNS DMARC: _dmarc.mydomain.io. TXT "v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s"
That ought to stop anyone trying to use your domains as source.
- tgv
The article speaks about DMARC monitoring, but not about "writing" it. So many orgs are too small to have someone paying attention of these things. Where I work, the CTO used to manage the DNS, but with very little understanding of what it all means. It was just copy and paste. And yes, it also says p=none. Probably because it was in the example. It's like setting up a website for your company, and picking some wordpress instance: how are you supposed to know the risks? It's just too much.
- cheema33
At our small 12-person company, I help manage DNS. Email service is through Microsoft. I had previously configured SPF and DKIM etc. but never DMARC. We are too small to have time for everything. But, I recently asked Claude to review the entire config and recommend changes. It suggested DMARC. I said, "implement it". And it did. It does have access to our Cloudflare/DNS account and make changes using terraform/opentofu in a way that allows me to review the changes before they are made.
LLMs are great for this sort of thing that used to be a massive pain in the rear.
- talkingtab
Email has been turned into a by-the-corporation, for-the-corporation service. Corporations need DMARC so they can control email and the ability to spam. The spam I cannot block is spam from Google.
If you decide to think about this, you will quickly realize that email is f*ked and needs to be forked. Perhaps we need a Community Email Initiative that blocks corporations and only allows Community members.
Trust is the one thing you can't buy on the Corporate Internet.
I am sure many people will be offended and down vote this comment because they cannot conceptualize an internet without Corporations.
- jwr
I really think we should be solving a much bigger problem of the major email providers not providing an automated way of handling abuse and not caring about abuse reports at all. Most of my spam comes from the three major email providers and at this point I gave up even trying to send abuse reports because they just get ignored.
The big companies do not have to care because nobody will block Google, Microsoft or Amazon. They are too big to fail.
Spoofing a From field is an insignificant problem in comparison.
- asimops
The domains that do enforce DMARC are apparently configured so badly that the German secure email provider mailbox.org decided not to honor DMARC.
See this thread in German:
https://userforum.mailbox.org/topic/10676-mailbox-org-akzept...