What DMARC Protects You From, and What It Does Not

3 hours ago

DMARC's actual scope is narrow: it only verifies whether the visible From domain authorized a message through aligned SPF/DKIM, not spam or phishing.
Three key terms: SPF lists authorized sending servers, DKIM provides a cryptographic signature, and DMARC ties either back to the visible From address.
Email has two 'from' addresses: envelope for routing and visible From for display; DMARC ensures authentication aligns with the visible one.
DMARC records live in DNS; examples show SPF, DKIM, and DMARC record syntax.
A DMARC pass requires either SPF or DKIM to authenticate and align with the visible From domain; relaxed mode allows same organizational domain, strict requires exact match.
DMARC does not inspect content—only provenance, leaving body, links, attachments, and intent unverified.
DMARC effectively stops exact-domain spoofing and provides aggregate reports to discover unauthorized senders.
DMARC fails to address lookalike domains, display-name impersonation, compromised mailboxes, authenticated malicious domains, spam filtering, and breaks with forwarding/mailing lists.
A DMARC pass confirms authorization, not trustworthiness; vendors overstating its phishing prevention leave users exposed.
Proper DMARC enforcement requires careful monitoring and remediation, not a blind switch to p=reject.

DMARC, introduced in 2012, is still not adopted by 45.1% of 67,336 domains checked; 68.4% either lack DMARC or have a non-enforcing policy.
Among domains with a DMARC record, 42.5% use p=none (monitor only), 27.7% use p=quarantine, and only 29.7% enforce p=reject.
The primary barrier to moving from p=none to enforcement is the difficulty of identifying all legitimate email senders from aggregate reports, which often contain cryptic or hashed rua= addresses.

PCI DSS v4.0.1 requires automated anti-phishing mechanisms under Requirement 5.4.1, mandatory since March 31, 2025; DMARC, SPF, and DKIM are cited as examples, not specific mandates.
Requirement 5.4.1 focuses on detecting and protecting personnel against phishing attacks; it is distinct from training requirement 12.6.3.1.
DMARC enforcement (p=quarantine or p=reject) is recommended by assessors but not required by the standard; p=none indicates monitoring only.

DKIM2 is a new version of DKIM that creates a verifiable chain of custody for emails, ensuring signatures remain valid through forwarding and preventing replay attacks.
DMARCbis is the successor to DMARC, replacing the static Public Suffix List with a live DNS tree walk and retiring ineffective tags, while incorporating operational improvements.
Stalwart v0.16.12 is the first mail server to fully implement both DKIM2 and DMARCbis, with a web-based playground for testing authentication without installation.

HMTP redesigns email on top of HTTP, replacing SMTP components with existing technologies like WebFinger, ActivityPub, and HPKE.
Discovery and delegation use a static JSON document at `.well-known/hmtp/user`, enabling per-user inbox delegation without DNS changes.
Identity is anchored to a domain with sigchains for key rotation, with domain control as a fallback for lost keys.

Hosting your own email server is feasible using a simple SMTP-only setup, bypassing IMAP and using existing email forwarding for receiving.
Essential requirements include a domain name and a 24/7 server, preferably a fixed-IP VPS, avoiding home servers with dynamic IPs.
Preparation involves unblocking port 25 from your hosting provider, checking IP reputation, and hardening server security.

DMARC, introduced in 2012, is still not adopted by 45.1% of 67,336 domains checked; 68.4% either lack DMARC or have a non-enforcing policy.
Among domains with a DMARC record, 42.5% use p=none (monitor only), 27.7% use p=quarantine, and only 29.7% enforce p=reject.
The primary barrier to moving from p=none to enforcement is the difficulty of identifying all legitimate email senders from aggregate reports, which often contain cryptic or hashed rua= addresses.

PCI DSS v4.0.1 requires automated anti-phishing mechanisms under Requirement 5.4.1, mandatory since March 31, 2025; DMARC, SPF, and DKIM are cited as examples, not specific mandates.
Requirement 5.4.1 focuses on detecting and protecting personnel against phishing attacks; it is distinct from training requirement 12.6.3.1.
DMARC enforcement (p=quarantine or p=reject) is recommended by assessors but not required by the standard; p=none indicates monitoring only.

DKIM2 is a new version of DKIM that creates a verifiable chain of custody for emails, ensuring signatures remain valid through forwarding and preventing replay attacks.
DMARCbis is the successor to DMARC, replacing the static Public Suffix List with a live DNS tree walk and retiring ineffective tags, while incorporating operational improvements.
Stalwart v0.16.12 is the first mail server to fully implement both DKIM2 and DMARCbis, with a web-based playground for testing authentication without installation.

HMTP redesigns email on top of HTTP, replacing SMTP components with existing technologies like WebFinger, ActivityPub, and HPKE.
Discovery and delegation use a static JSON document at `.well-known/hmtp/user`, enabling per-user inbox delegation without DNS changes.
Identity is anchored to a domain with sigchains for key rotation, with domain control as a fallback for lost keys.

Hosting your own email server is feasible using a simple SMTP-only setup, bypassing IMAP and using existing email forwarding for receiving.
Essential requirements include a domain name and a 24/7 server, preferably a fixed-IP VPS, avoiding home servers with dynamic IPs.
Preparation involves unblocking port 25 from your hosting provider, checking IP reputation, and hardening server security.

Hasty Briefsbeta