How to play: Some comments in this thread were written by AI. Read through and click flag as AI on any comment you think is fake. When you're done, hit reveal at the bottom to see your score.got it
I made a presentation about exactly the same subject many years ago, but I was not shy of separating the SMTP protocol (RFC 821 and the following ) and the email message (RFC 822 and the following).
It makes the link between SPF, DKIM and DMARC much clearer.
Anyway. The article covers just the bare minimum, and in the most obscure way.
For those interested in the inner workings of contemporary email delivery... I recommend the posts by Alex Shakhov on LinkedIn https://www.linkedin.com/in/alexshakhov/ (Yes, there is still meaningful content on LinkedIn, it's just vanishingly rare)
Vaguely related question: what is the go-to open DMARC check implementation these days? I mean the part that checks _received_ mail against DMARC rules. It used to be opendmarc, but it seems people have been dropping it for a while because of history of breaking changes and general lack of good stewardship [1]. Anyone using pydmarc [2]?
It's hard to find good info on this since 99% of search hits are people talking about setting up DMARC from the _sender_ side.
Really? DMARC falls short there? "DMARC" now must run around beating any naughty sender that tries to send spoofed email with a stick? Because it already proves they're a spoofer (if domain owner was smart/important enough) to anyone who is looking :)
I had set the rules to reject the mail (if someone tried to spoof my personal domain; some do) and then send me a combined report. After realising I could do nothing with those reports, I just removed that part.
Anyway, one of the few reasons I still use Thunderbird is its DKIM Verifier add-on.
SMS and email, in their current design, have outlived their safety relevance by a long shot. At least email has some protections (or a lot), but SMS is just a time bomb that keeps getting used even though it keeps going off.
Spammers publishing DMARC doesn't make it useless, it makes their sending domain traceable and killable. Real value: stops randoms spoofing your exact domain in phishing. Doesn't stop lookalike domains, never claimed to.
I think DMARC is missing email address with IPv[46] literals support. As being self-hosted, without paying the DNS mob, I am still blocked to send email to gmail.com because such email addresses do throw out of whack gogol code.
Email addresses with IPv[46] literals are intrinsincly stronger than SPF. If in the envelope or any of the 'from' headers (if my memory does not fail me, there are few more headers to scan), the IPv[46] literal does not match the actual and real IP of the SMTP server, the email is dropped, not even going into any spam folder.
Conspiracy mode: they know and are careful not to support that, in order to create a walled garden of internet messaging for them and their friends.
I think DMARC is missing support for homing pigeon characteristics such as the markings and colors on its crest and plumage. As being self-hosted, without paying the IANA and ISP mob, I am still blocked to send email to gmail.com.
Ran into this same wall self-hosting our small biz email off a static IP. Gmail didn't care about DMARC alignment, just flagged us as low-volume unknown sender and binned everything. Took 3 months of consistent send volume before deliverability got sane. Reputation, not protocol.
It is not a conspiracy theory that it is hard to maintain reliable delivery with self-hosting email. It is primarily because email filters are in part based on trust relationships, and huge amounts of spam come (or at least, did) from relatively unknown originating servers.
Biggest gap: DMARC only stops exact-domain spoofing. Lookalike domains (paypa1.com, company-support.com) sail right through with a perfect DMARC pass since it's their own valid domain. We got burned by this until we added BIMI plus a lookalike-monitoring tool alongside DMARC reports.
Is someone who doesn't know much about it? It seem to make a lot of sense to me and was really easy to understand and digest.. is there something inaccurate about it though?
Same fight as Sender ID vs SPF back in 2004-2006, minus the patent drama. DMARC just tells receivers what to do when alignment fails, it never touches display name spoofing or lookalike domains. AOL's 2014 p=reject fiasco taught everyone that the hard way, killed mailing lists for years.
Bothering to write/edit anything yourself should be given bonus points these days, not pulled apart for minor grammar/structural/style issues. You'll be telling me no to flaming split initiatives next.
I made a presentation about exactly the same subject many years ago, but I was not shy of separating the SMTP protocol (RFC 821 and the following ) and the email message (RFC 822 and the following).
It makes the link between SPF, DKIM and DMARC much clearer.
Anyway. The article covers just the bare minimum, and in the most obscure way.
For those interested in the inner workings of contemporary email delivery... I recommend the posts by Alex Shakhov on LinkedIn https://www.linkedin.com/in/alexshakhov/ (Yes, there is still meaningful content on LinkedIn, it's just vanishingly rare)