4 ms·

I set up SPF, DKIM and DMARC on my email 3-4 years ago. That is to say, I just picked a lenient DMARC policy and started collecting reports. I've been collect

by sshine 3y ago

I set up SPF, DKIM and DMARC on my email 3-4 years ago. That is to say, I just picked a lenient DMARC policy and started collecting reports. I've been collecting reports ever since, because I'm not sure why I should care. I mostly don't get spam emails, and I mostly don't have legit emails marked as spam. (I might have had two false positives and two false negatives in the last two years.) I don't have a system for going through those XML DMARC blobs I get sent. So they just get their own inbox folder that I never look at. So... I almost figured out how DMARC works, and I don't care

josefresco 3y ago
Your experience matches mine exactly. Client has a spoofing problem, we setup DMARC, reports are sent, not much is found. Client is billed. Client grumbles. Reports keep coming. Not much is found. Reports get ignored.
- zippergz 3y ago
  DMARC reports are not good for "keep an eye on who is spoofing my domain and then take action on it." But what they ARE good for is finding gaps in your DMARC policy. Like "oops, I forgot to add the helpdesk ticketing system to the policy" or "huh, it looks like the marketing department started using a new email provider, and they're not covered by the policy." In other words, it's useful for spotting legitimate stuff that's accidentally failing, not for doing anything with the unauthorized stuff. For a personal domain that only one or two people use, this is less likely to be worth bothering with.
  - windexh8er 3y ago
    I get reports showing attempts at least one a month per domain, a few in a week trying root and then subdomains. So I do like the fact that I know the policy I have implemented is useful. I do wish, however, that there was more useful information in the reports and that a variation of forensic reporting was more of a thing. But you're spot on with finding gaps. It's basically the premise for every commercial DMARC product on the market. It's also crazy to see how companies blindly trust and never remediate senders from having access to corporate domains. I'll, however, disagree with regard to personal domains. It's not hard. Do it. Everyone who helps clean up these things makes a small difference. If you own your own domain and are leveraging email this should be table stakes. I have recommended MailHardener [0] (no affiliation) in the past for their fantastic documentation around SPF, DKIM, DMARC, BIMI, etc - but also they have a free tier of one domain and they provide a grade with respect to your posture. It's really simple, and people I know have used it to learn how to implement these configurations on a broader scale. [0] https://www.mailhardener.com/ https://www.mailhardener.com/
    - zippergz 3y ago
      I have definitely done it for my personal domains and I agree that it's not particularly hard. I just meant that for my personal domains I have not found the reports as useful as I do in business contexts, because I am the only person sending mail from those domains and it's (mostly) unlikely that I'd spin up a new source and forget to add it to the DMARC policy.
eastbound 3y ago
CloudFlare includes a solution to collect DMARC records. It still tells you how many occurrences are trying to impersonate you.
remram 3y ago
How do you know your false positive rate if you ignore the reports?
- sshine 3y ago
  To clarify: The false positives/negatives are for the spam filter, not DMARC specifically. My DMARC policy is lenient, so it only ever creates reports that I don't read, it never filters. False positive: A legit email ends up in my spam folder. False negative: A spam email ends up in my inbox. I check my spam folder occasionally, so that's how I count false positives. As far as I understand from this thread, maintaining a DMARC policy set makes more sense for bigger companies that have a lot of automated email traffic and a lot of consistently shaped traffic between larger groups. My Microsoft email at work is full of useless notifications because we don't have policies set up that whitelist our main customers or even our own automated tools. ("You don't often get emails from Jira!" -- if only.)

by sshine 3y ago

josefresco 3y ago

Your experience matches mine exactly. Client has a spoofing problem, we setup DMARC, reports are sent, not much is found. Client is billed. Client grumbles. Reports keep coming. Not much is found. Reports get ignored.

zippergz 3y ago
DMARC reports are not good for "keep an eye on who is spoofing my domain and then take action on it." But what they ARE good for is finding gaps in your DMARC policy. Like "oops, I forgot to add the helpdesk ticketing system to the policy" or "huh, it looks like the marketing department started using a new email provider, and they're not covered by the policy." In other words, it's useful for spotting legitimate stuff that's accidentally failing, not for doing anything with the unauthorized stuff. For a personal domain that only one or two people use, this is less likely to be worth bothering with.
- windexh8er 3y ago
  I get reports showing attempts at least one a month per domain, a few in a week trying root and then subdomains. So I do like the fact that I know the policy I have implemented is useful. I do wish, however, that there was more useful information in the reports and that a variation of forensic reporting was more of a thing. But you're spot on with finding gaps. It's basically the premise for every commercial DMARC product on the market. It's also crazy to see how companies blindly trust and never remediate senders from having access to corporate domains. I'll, however, disagree with regard to personal domains. It's not hard. Do it. Everyone who helps clean up these things makes a small difference. If you own your own domain and are leveraging email this should be table stakes. I have recommended MailHardener [0] (no affiliation) in the past for their fantastic documentation around SPF, DKIM, DMARC, BIMI, etc - but also they have a free tier of one domain and they provide a grade with respect to your posture. It's really simple, and people I know have used it to learn how to implement these configurations on a broader scale. [0] https://www.mailhardener.com/ https://www.mailhardener.com/
  - zippergz 3y ago
    I have definitely done it for my personal domains and I agree that it's not particularly hard. I just meant that for my personal domains I have not found the reports as useful as I do in business contexts, because I am the only person sending mail from those domains and it's (mostly) unlikely that I'd spin up a new source and forget to add it to the DMARC policy.

eastbound 3y ago

CloudFlare includes a solution to collect DMARC records. It still tells you how many occurrences are trying to impersonate you.

remram 3y ago

How do you know your false positive rate if you ignore the reports?

sshine 3y ago
To clarify: The false positives/negatives are for the spam filter, not DMARC specifically. My DMARC policy is lenient, so it only ever creates reports that I don't read, it never filters. False positive: A legit email ends up in my spam folder. False negative: A spam email ends up in my inbox. I check my spam folder occasionally, so that's how I count false positives. As far as I understand from this thread, maintaining a DMARC policy set makes more sense for bigger companies that have a lot of automated email traffic and a lot of consistently shaped traffic between larger groups. My Microsoft email at work is full of useless notifications because we don't have policies set up that whitelist our main customers or even our own automated tools. ("You don't often get emails from Jira!" -- if only.)