3 ms·

As I’m guessing most of the people on HN do, I’ve got many domains that I’ve purchased after having had an idea that never had anything done with them. I gener

As I’m guessing most of the people on HN do, I’ve got many domains that I’ve purchased after having had an idea that never had anything done with them. I generally try to make sure they all redirect back to my site, but I’ve never even thought to do anything with incoming mail and certainly never with outgoing. As soon as I read the title it clicked, it’s obvious, but it’s never occurred to me...

brightball 6y ago
Nope, you're totally correct. Anytime I give a DMARC talk this is actually the example that I use (all the domains that you buy and don't use). At the end, I close by telling people to go home and turn off email from those domains with the sample SPF and DMARC records that mirror these.
- chrismeller 6y ago
  Do you happen to know of a tool that does a comprehensive check of your email configuration? I can find individual tools for SPF, DKIM, etc., but it’d be great if there were one that just have me a big green check mark or something.
  - brightball 6y ago
    DMARC reports actually do this for you. They'll provide a report about how every IP address claiming to send on behalf of your domain is doing. dmarcian does a great job of helping you make sense of these by grouping all of the traffic by sending source and then letting you drill down for more details. There's also a cool "TMI Mode" on the SPF checker if you have an account that will use the traffic from your DMARC reports to show you which parts of the record it's associated with. Each sending source (Google, Sendgrid, Mailgun, Mailchimp, etc) needs to be verified for DMARC alignment. Alignment is important because you can pass DKIM using a domain that's totally different than the one that the message claims to be from. DMARC alignment addresses that gap. * Disclosure, I work for dmarcian
    - ryan29 6y ago
      Edit: Below brightball pointed out they support inactive domains, so my complaint about not being able to add inactive domains wasn't accurate. I deleted it.
      - brightball 6y ago
        For what it’s worth, dmarcian has allowed inactive domains free for many years. I’m sorry if that wasn’t clear from the pricing description. We’d love to have you try us out again.
        ryan29 6y ago
        No. It's fairly clear. I just didn't read past the "2 active domains" part of the pricing. I'll edit my post and I will actually give it another try.
pontifier 6y ago
Head slapping moment for me too. Without a DMARC record I would never even know that it's happening. I wonder if the systems that generate the DMARC reports could be set up to keep historical data for domains with DMARC shut off. When DMARC is turned on, domain owners would be able to see what has been going on without them knowing. It might be a bit of a shock to some. I learned a lot from my first report.

brightball 6y ago

Nope, you're totally correct. Anytime I give a DMARC talk this is actually the example that I use (all the domains that you buy and don't use). At the end, I close by telling people to go home and turn off email from those domains with the sample SPF and DMARC records that mirror these.

chrismeller 6y ago
Do you happen to know of a tool that does a comprehensive check of your email configuration? I can find individual tools for SPF, DKIM, etc., but it’d be great if there were one that just have me a big green check mark or something.
- brightball 6y ago
  DMARC reports actually do this for you. They'll provide a report about how every IP address claiming to send on behalf of your domain is doing. dmarcian does a great job of helping you make sense of these by grouping all of the traffic by sending source and then letting you drill down for more details. There's also a cool "TMI Mode" on the SPF checker if you have an account that will use the traffic from your DMARC reports to show you which parts of the record it's associated with. Each sending source (Google, Sendgrid, Mailgun, Mailchimp, etc) needs to be verified for DMARC alignment. Alignment is important because you can pass DKIM using a domain that's totally different than the one that the message claims to be from. DMARC alignment addresses that gap. * Disclosure, I work for dmarcian
  - ryan29 6y ago
    Edit: Below brightball pointed out they support inactive domains, so my complaint about not being able to add inactive domains wasn't accurate. I deleted it.
    - brightball 6y ago
      For what it’s worth, dmarcian has allowed inactive domains free for many years. I’m sorry if that wasn’t clear from the pricing description. We’d love to have you try us out again.
      - ryan29 6y ago
        No. It's fairly clear. I just didn't read past the "2 active domains" part of the pricing. I'll edit my post and I will actually give it another try.

pontifier 6y ago

Head slapping moment for me too. Without a DMARC record I would never even know that it's happening. I wonder if the systems that generate the DMARC reports could be set up to keep historical data for domains with DMARC shut off. When DMARC is turned on, domain owners would be able to see what has been going on without them knowing. It might be a bit of a shock to some. I learned a lot from my first report.