3 ms·

> And doing dmarc properly requires a reporting service. This is incorrect. DMARC requires nothing but an email address to send reporting to. It costs nothin

> And doing dmarc properly requires a reporting service. This is incorrect. DMARC requires nothing but an email address to send reporting to. It costs nothing to implement and there are open source [0] solutions out there if you want to monitor the reporting being sent. And to clarify - the reporting you're getting back from a DMARC is either an aggregate or a forensic report. There aren't many email providers that actually send forensic reporting anymore, the 99% of reports you'll get are aggregate in nature. And finally, remember that if you don't have a policy of "REJECT" set on your domains, DMARC isn't doing you a whole lot of good. [0] https://github.com/domainaware/parsedmarc https://github.com/domainaware/parsedmarc

scoot 5y ago
> This is incorrect. DMARC requires nothing but an email address to send reporting to. This is also incorrect. Reporting (rua/ruf) are optional. > if you don't have a policy of "REJECT" set on your domains, DMARC isn't doing you a whole lot of good. With "quarantine" failing emails will go to spam, which is plenty good enough in most cases.
- royce 5y ago
  Being able to firmly reject all unauthenticated messages is still the target end state. The risk of a threat actor sending an email that looks completely legit, and simply asking the user to "check their spam folder", is very real.
- deleted 5y ago
  [deleted]
- windexh8er 5y ago
  > This is also incorrect. Reporting (rua/ruf) are optional. I never stated RUA/RUF were required. My intent was to state that the parent I was replying to implied "services" or "servers" were required to collect and/or process reporting. One can simply collect reporting and process offline or simply consume manually. I do this, personally, for a few low email volume domains I own. You can't get RUA/RUF any other way.
  - deleted 5y ago
    [deleted]
  - scoot 5y ago
    You stated that an email address is required. It's optional. So the requirements are effectively non-existent (although who doesn't have an email address). > You can't get RUA/RUF any other way. There are free services that provide analysis, such as https://dmarc.postmarkapp.com/ https://dmarc.postmarkapp.com/, although arguably you still need an email address to sign up. But it is another, actually useful, way to receive the reports.
    - windexh8er 5y ago
      Yes, an email address is required to get RUA/RUF. I never stated this was or wasn't in line with the RFC. > There are free services that provide analysis, such as https://dmarc.postmarkapp.com/ https://dmarc.postmarkapp.com/, although arguably you still need an email address to sign up. YES. That's what I said.

scoot 5y ago

> This is incorrect. DMARC requires nothing but an email address to send reporting to. This is also incorrect. Reporting (rua/ruf) are optional. > if you don't have a policy of "REJECT" set on your domains, DMARC isn't doing you a whole lot of good. With "quarantine" failing emails will go to spam, which is plenty good enough in most cases.

royce 5y ago
Being able to firmly reject all unauthenticated messages is still the target end state. The risk of a threat actor sending an email that looks completely legit, and simply asking the user to "check their spam folder", is very real.
deleted 5y ago
[deleted]
windexh8er 5y ago
> This is also incorrect. Reporting (rua/ruf) are optional. I never stated RUA/RUF were required. My intent was to state that the parent I was replying to implied "services" or "servers" were required to collect and/or process reporting. One can simply collect reporting and process offline or simply consume manually. I do this, personally, for a few low email volume domains I own. You can't get RUA/RUF any other way.
- deleted 5y ago
  [deleted]
- scoot 5y ago
  You stated that an email address is required. It's optional. So the requirements are effectively non-existent (although who doesn't have an email address). > You can't get RUA/RUF any other way. There are free services that provide analysis, such as https://dmarc.postmarkapp.com/ https://dmarc.postmarkapp.com/, although arguably you still need an email address to sign up. But it is another, actually useful, way to receive the reports.
  - windexh8er 5y ago
    Yes, an email address is required to get RUA/RUF. I never stated this was or wasn't in line with the RFC. > There are free services that provide analysis, such as https://dmarc.postmarkapp.com/ https://dmarc.postmarkapp.com/, although arguably you still need an email address to sign up. YES. That's what I said.