DMARC's Real Powers and Its Blind Spots
What DMARC Protects You From, and What It Does Not
DMARC is often mistaken for a spam or phishing filter, but it only verifies that the visible From address is authorized via aligned SPF or DKIM. This article clarifies what DMARC actually protects against—exact-domain spoofing—and what it doesn't: lookalike domains, display-name impersonation, compromised mailboxes, and authenticated malicious senders. It also explains the mechanics of SPF, DKIM, and DMARC alignment, and warns that reaching p=reject without addressing these gaps creates a false sense of security.
Authentication cannot tell a real user apart from an attacker controlling that user's account.
- sam_lowry_
> Every email carries two "from" addresses
I made a presentation about exactly the same subject many years ago, but I was not shy of separating the SMTP protocol (RFC 821 and the following ) and the email message (RFC 822 and the following).
It makes the link between SPF, DKIM and DMARC much clearer.
Anyway. The article covers just the bare minimum, and in the most obscure way.
For those interested in the inner workings of contemporary email delivery... I recommend the posts by Alex Shakhov on LinkedIn https://www.linkedin.com/in/alexshakhov/ (Yes, there is still meaningful content on LinkedIn, it's just vanishingly rare)
- avian
Vaguely related question: what is the go-to open DMARC check implementation these days? I mean the part that checks _received_ mail against DMARC rules. It used to be opendmarc, but it seems people have been dropping it for a while because of history of breaking changes and general lack of good stewardship [1]. Anyone using pydmarc [2]?
It's hard to find good info on this since 99% of search hits are people talking about setting up DMARC from the _sender_ side.
[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1014058#39
- joladev
> Here is the part that trips people up.
It's hard to take something seriously when it's very clearly AI generated. It's just a coin toss on whether the information in the article is correct.
- crossroadsguy
> Where it falls short
Really? DMARC falls short there? "DMARC" now must run around beating any naughty sender that tries to send spoofed email with a stick? Because it already proves they're a spoofer (if domain owner was smart/important enough) to anyone who is looking :)
I had set the rules to reject the mail (if someone tried to spoof my personal domain; some do) and then send me a combined report. After realising I could do nothing with those reports, I just removed that part.
Anyway, one of the few reasons I still use Thunderbird is its DKIM Verifier add-on.
SMS and email, in their current design, have outlived their safety relevance by a long shot. At least email has some protections (or a lot), but SMS is just a time bomb that keeps getting used even though it keeps going off.
- thesuitonym
Bad article, probably a bad product.