DMARC Has Been Public Since 2012. 68.4% of Domains Still Don't Enforce It

https://ciphercue.com/blog/dmarc-enforcement-gap-rua-fragmentation-2026

26•adulion•3h ago

Comments

smartmic•56m ago

I am self-hosting my (secondary) email and have only implemented SPF and DKIM. This works fine on a practical level for me. What would be the benefit of setting up DMARC on top?

asimpletune•52m ago

Because if someone spoofs an email coming from your domain DMARC tells the receiver what to do with the spoofed email.

kamma4434•44m ago

And what is the sane way to handle a spoofed email?

azeemba•40m ago

That's what the policy setting tells the recipient. You can tell them to trest it as normal, send it to spam or delete it.

The report that they send you is useful for you to make sure your emails that you expect to go through are going through.

comrade1234•43m ago

Google, Microsoft, Amazon and others send me summary reports of people spoofing my domains. I have dmarc set for them to accept the email, mark it spam (presumably) and send me a report. I really should and can tell them to reject the spam completely - another setting in dmarc but haven't yet out of laziness basically.

AshamedCaptain•42m ago

And SPF doesn't?

ivlad•27m ago

Technically, no.

SPF allows to say “these IPs are authorised to send emails as example.com”, where DMARC allows to say “I as domain owner recommend to quarantine emails that fail SPF and DKIM”, it also allows finer alignment (ie, matching between different “from” parameters) configuration and reporting by the receivers.

Of course, with absence of DNARC policies, receivers default to some internal defaults, or may ignore the policies altogether. But at least, the big ones send DMARC reports.

wolttam•22m ago

Not always. An email has a valid SPF when its return path email’s domain permits the sending server’s IP. But that email may have a forged From: header (which causes an SPF mis-alignment), and the receiving server checks the DMARC of *the From header* domain to determine how to handle that mis-alignment.

bombcar•21m ago

The biggest benefit I saw in a small domain was greatly reduced backscatter spam. Before someone’d randomly make up a billion emails on my domain and send “from” them, and I’d get various out of office replies, etc (catch all) - that basically never happens anymore.

tgv•52m ago

The article speaks about DMARC monitoring, but not about "writing" it. So many orgs are too small to have someone paying attention of these things. Where I work, the CTO used to manage the DNS, but with very little understanding of what it all means. It was just copy and paste. And yes, it also says p=none. Probably because it was in the example. It's like setting up a website for your company, and picking some wordpress instance: how are you supposed to know the risks? It's just too much.

jwr•32m ago

I really think we should be solving a much bigger problem of the major email providers not providing an automated way of handling abuse and not caring about abuse reports at all. Most of my spam comes from the three major email providers and at this point I gave up even trying to send abuse reports because they just get ignored.

The big companies do not have to care because nobody will block Google, Microsoft or Amazon. They are too big to fail.

Spoofing a From field is an insignificant problem in comparison.

cube00•20m ago

It's ironic that I set everything up correctly on my self hosted domain and still end up in spam because of my low volume.

I even go to the trouble of registering in their Postmaster Tools which only tell me:

  Not enough outgoing email
  You haven't sent enough email to personal Gmail (@gmail.com) accounts to determine deliverability status for your domain and messages.

Then on the other hand Google can flood me with spam filled Google Calendar Invites and Google Drive Share notifications, all fully signed because they are coming out of those services, all day long.

nubinetwork•23m ago

I'll set up DMARC after I get DKIM working... migrating my homelab has been taking forever...

talkingtab•20m ago

Email has been turned into a by-the-corporation, for-the-corporation service. Corporations need DMARC so they can control email and the ability to spam. The spam I cannot block is spam from Google.

If you decide to think about this, you will quickly realize that email is f*ked and needs to be forked. Perhaps we need a Community Email Initiative that blocks corporations and only allows Community members.

Trust is the one thing you can't buy on the Corporate Internet.

I am sure many people will be offended and down vote this comment because they cannot conceptualize an internet without Corporations.

baron3dl•10m ago

You can do this right now, and you don't even need to fork anything. E-mail is an internet scale protocol that's not owned or ownable, except by convention. Since you specifically want to cut out Google, and their attempts to capture E-mail are what makes rolling your own E-mail hard anyway, just go for it.

Depending on how hard you want to make it, you can slap all the parts together yourself or use something like Zimbra, Mailcow, iRedMail, mail-in-a-box.

The advantage over a fork, whatever specifically that means, is any service that needs E-mail as an identity verification, still works.

rft•16m ago

Article is missing a note on the existence of MX records for the domains. Sure, you can easily have a send-only domain without an MX record, but the common case is likely to setup both send and receive capability. It would be interesting to have that number included as domains without MX and DMARC might just not be configured for email at all. Worst case the 45% of domains without DMARC are simply not relevant for email and thus not configured at all. I would find "x% of domains with configured email don't enforce DMARC" more interesting.

datakan•10m ago

68.4% is actually a lot. Considering how badly abused email has always been, I'm actually surprised its nearly 70% and growing. Cup half full I guess

7.1 Earthquake in Japan

Show HN: Formally verified 3D CSG: Trust 93 lines spec, not 1000 lines AI code

New HIV vaccine shows unprecedented success in preclinical study

About the security content of macOS Tahoe 26.6

Show HN: tale.fyi, we deserve a home for fiction

Google's Beyond Zero: Enterprise Security for the AI Era

Our position on open-weights models

Kimi Linear: An Expressive, Efficient Attention Architecture

How to Survive Boiling Water

Fast Remediation Is the New Trust Model (JFrog and OpenAI Zero-Day Findings)

What AI developers could learn from Charles Bukowski?

DMARC Has Been Public Since 2012. 68.4% of Domains Still Don't Enforce It

Show HN: Ctrlb-decompose: Strip the noise from logs before sending to LLMs

A $500 RL fine-tune of a 9B open model beat frontier models on catalog review

Mondragon Corporation – a federation of co-operatives

Show HN: Scala Tutorials – interactive Scala 3 lessons in the browser

Dolmenwood: Fantasy RPG built around the acclaimed Old-School Essentials rules

Over 150k Flights: Airlines Just Flew the Busiest Day in Recorded History

Benchmarking Opus 5 on SlopCodeBench

Can LLMs identify 16 cards in 45 bit-queries?

Solving Fermat: Andrew Wiles

Usenet Archive Toolkit – process Usenet messages into a searchable archive

Ars Astronomica – English translations of rare Hebrew and Latin astronomy texts

Show HN: Segue – Save context in one AI, load it in another by a short handle

Vehicle Motion Cues

Watching Go's new garbage collector move through the heap

Show HN: Vivari – Open-Source WebContainer for Node, Bun, and Python

PyTorch: A Reference Language

UpCodes (YC S17) is hiring remote AE's to help make buildings cheaper

TWC Classics

DMARC Has Been Public Since 2012. 68.4% of Domains Still Don't Enforce It

Comments

7.1 Earthquake in Japan

Show HN: Formally verified 3D CSG: Trust 93 lines spec, not 1000 lines AI code

New HIV vaccine shows unprecedented success in preclinical study

About the security content of macOS Tahoe 26.6

Show HN: tale.fyi, we deserve a home for fiction

Google's Beyond Zero: Enterprise Security for the AI Era

Our position on open-weights models

Kimi Linear: An Expressive, Efficient Attention Architecture

How to Survive Boiling Water

Fast Remediation Is the New Trust Model (JFrog and OpenAI Zero-Day Findings)

What AI developers could learn from Charles Bukowski?

DMARC Has Been Public Since 2012. 68.4% of Domains Still Don't Enforce It

Show HN: Ctrlb-decompose: Strip the noise from logs before sending to LLMs

A $500 RL fine-tune of a 9B open model beat frontier models on catalog review

Mondragon Corporation – a federation of co-operatives

Show HN: Scala Tutorials – interactive Scala 3 lessons in the browser

Dolmenwood: Fantasy RPG built around the acclaimed Old-School Essentials rules

Over 150k Flights: Airlines Just Flew the Busiest Day in Recorded History

Benchmarking Opus 5 on SlopCodeBench

Can LLMs identify 16 cards in 45 bit-queries?

Solving Fermat: Andrew Wiles

Usenet Archive Toolkit – process Usenet messages into a searchable archive

Ars Astronomica – English translations of rare Hebrew and Latin astronomy texts

Show HN: Segue – Save context in one AI, load it in another by a short handle

Vehicle Motion Cues

Watching Go's new garbage collector move through the heap

Show HN: Vivari – Open-Source WebContainer for Node, Bun, and Python

PyTorch: A Reference Language

UpCodes (YC S17) is hiring remote AE's to help make buildings cheaper

TWC Classics