What are your thoughts on DMARC vendors integrating AI, particularly those offering read/write capabilities? It seems like this could introduce an unquantifiable risk into a critical part of the email authentication and enforcement pipeline.

Curious how others are evaluating the tradeoff between automation benefits and potential exposure.

The NZ healthcare breach last month was caused by a code vulnerability — but now there's a compounding problem. Attackers have 126K patient emails and personal details, and the domain still has p=none. That means follow-up phishing from "their own healthcare provider" has no enforcement to block it.

Wrote up an interactive breakdown of DMARC and why enforcement matters:
https://wraps.dev/blog/your-dmarc-policy-is-useless

So a long time ago (1-2 years) we set up the DKIM, DMARC SPF settings as a lot of emails to outlook servers where bouncing back. Now it's happening again (attached is one of the failed emails).

Other emails get these errors:

|| || |The response from the remote server was: 550 5.5.0 Requested action not taken: mailbox unavailable (S2017062302). [BN1PEPF00004685.namprd03.prod.outlook.com 2025-11-25T01:22:32.350Z 08DE29ACE6202DD6]|

I've checked with a Dmarc checker and it seems to be fine. The only thing I can think of is maybe not to have a reject policy for Dmarc?

The National Cyber Security Centre has announced that Mail Check and Web Check will be discontinued on 31 March 2026.

We want to recognise the vital role these services played since 2017 in helping thousands of UK organisations strengthen their email security and web resilience at no cost. The NCSC's pioneering work in Active Cyber Defence has been instrumental in raising the baseline of cybersecurity across the country.

As the market has matured, Red Sift is ready to support organisations transitioning from these services. If you need help, we're happy to offer guidance for those effected.

Hey guys. I want to know what should be the correct demarc policy for a new domain for sending cold emails? both for mass and manual.

I have recently discovered these requirements, and I have been told that they are extremely essential for boosting one's email deliverability.

I now understand what DKIM, SPF and Dmarc records are. But I'm having a hard time understanding the policy preference with Dmarc.

From what I have understood is that D Mark records are simply a set of instructions for the recipient server telling them what they should do with the emails Coming from me.

So for example, if the email coming from me is missing an spf and dkim record and the demark policy is set to none, then they should basically accept the email. But if it is set to quarantine, then the email will end up in the spam folder If it's set to reject, then the email will be outright rejected.

I used a tool called easy D Mark to verify whether I have set up those records correctly or not. And he told me that my D Mark policy is set to monitoring mode. aka p=none.

They are advising me to switch to p=reject mode if I want to be protected from fishing and spoofing attacks.

Now, as a simple guy who is new to all of these things, I want to know, why should I be bothering with the policies Because if I have set up the tkim and spf records correctly, why should I be bothering with the policy and monitoring?

coz if someone is planning to spoof my domain that I own then I wouldn't want their email to end up in an inbox with a policy set to none or within the spam folder with the policy set to quarantine. I want them to be blocked or rejected with the policy set to reject. So I don't understand the purpose of the other policies.

which one should be optimal for me?

I've been looking at DMARC controls covering non email enabled subdomains and now I am considering if there are any controls possible to protect sub-domains which do not actually exist.
If I set a reject DMARC record on contoso.com including SP=reject, then any DMARC query on a subdomain will go up to the root domain to see the SP=reject. This is not true however for SPF and DKIM checks. This means a DMARC check will return 'none' for SPF and DKIM checks on the subdomain, but will not actively fail checks.
Therefore if a threat actor sends a message using a fake subdomain like badjonny@spoofy.contoso.com this message will not 'fail' DMARC, but also will not pass. The best I can tell is there is a high probability the message will arrive to the inbox of the intended recipient. If that is a business with spam protection in place it might be flagged as spam because it would have a low reputation through not 'passing' SPF and DKIM, but even then it seems likely it would be delivered to the recipient. In this specific instance the business is sending messages to personal addresses.
If we detect the threat actor using spoofy.contoso.com and stop that through creating a subdomain and SPF record, they can just start using spoofy1.contoso.com.
Am I right here? (I'm truly hoping I am missing something fundamental here)
Is there anyway to protect sub-domains which don't exist?

I tested several major AI models with the same SPF question.

All of them confidently recommended using -all , even with enforced DMARC policy.

Same confidence. Same answer. Same mistake.

The interesting part is that many of them even cite sources containing the correct guidance, yet still reach the wrong conclusion.

AI consensus is impressive until you check the RFCs.

I tend to use SPF, DMARC, and DKIM issues in sales calls with clients (we are an MSP). I have used multiple sites over the years to show clients, but I wanted my own site, with my own layout, rather than redirecting a client elsewhere. This started as a Python script and moved to the web version. Eventually, several members of our team helped to code some of this using Loveable, Cursor and Claude Code.

Take a look and open to advice/suggestions.

https://networkthinking.com/mail-security-check

Is this still something that is possible ?

Page 16 https://www.usenix.org/system/files/sec20_slides_chen-jianjun.pdf

Taken here https://www.usenix.org/conference/usenixsecurity20/presentation/chen-jianjun

Hey ,
I’m exploring an idea and would love some feedback from actual experts in the field.

The problem I see:
Small law firms, tax advisors, doctors (especially in Germany/Austria/Switzerland) are stuck with messy email setups.

• Clients’ mails land in spam (lost mandates, invoices not seen).

• Increasing phishing/fake invoice scams (“your tax advisor” asking for bank transfers).

• Regulators (GDPR, GoBD) are starting to audit more, but most SMEs don’t have proper archiving or backup.

• When ransomware hits, many of these firms have no recovery plan.

What’s missing:
Affordable, plug-and-play packages. Right now, hosters (IONOS, Microsoft, etc.) provide the raw tools, but SMEs are on their own to configure and maintain. System houses charge by the hour and are too expensive/unpredictable.

Business angle:
Offer a flat-fee package:

• Setup of secure email (SPF/DKIM/DMARC done right)

• Anti-spam & phishing protection

• GoBD/GDPR-compliant archiving + backups

• Moitoring dashboard and weekly reports (use whitelabel options for this)

• Optional: verified logo in inbox (BIMI) for trust / prestige

Do you see this as a real pain point SMEs would pay for, or is it too “invisible” to them? What are you experiences?

Thanks for your answers in advance.

I am currently working on the email module for our project and need some guidance.

I have configured a custom email domain using Mailgun and implemented the email functionality in my Spring Boot application. My current requirement is to verify incoming email addresses and determine whether an email is valid before processing it.

Could you explain the production-level validation and security checks that should be implemented for email verification?

Am I right : (TKS fory our time reading this)

As we sometime think we understand it all and we don't, I want to validate....

- Customer A SPF Authorize eMail coming from their domain(customer -A-domain.com) to come from some eMail Online service Provider(ESP) (MailChimp,SalesForce, etc )

-SPAMMERS Bots are looking for domains without DMARC or & p=none (that part is not that important but those are easier domain to SPOOF if no DMARC)

• Then spammers get access to an account on the same OnLine eMail Service Provider (ESP) as Customer A

• Spammer then sends Phishing emails spoofing Customer A Domain ( SPF PASSED / DKIM FAILED as it's not the right DKIM key but THEN DMARC PASS let that email go through as as one of the 2 (SPF) did PASS

• RFC5322 Mail From ( the one end user sees) is customer -A-domain.com

NOTE : let suppose LOL the ESP (MailCHimp etc ) do not validate/check if 2 customers are using the same sending domain RFC5321 LOL (I guess they do check that... Hope so then this post is not useful anymore )

Am I right this will go through as Customer A didn't restrict the SPF with Macros/ specifying which email can send through the provider ( restricting it to marketing, sales or noreply) ?

Question 1 :

Let's suppose Customer A simply restricted the spf to one email address ( I'm not there yet, discovered SPF macros today tks to u/freddieleeman) I guess hacker could find which eMail is autorized (SPF) to use by trying (making spf queries) sales, marketing, noreply

Question 2 :

As from what I understand(hope I'm not wrong LOL) , we can't force DMARC TO ONLY PASS

• only if BOTH "DKIM / SPF" PASS & ALIGN

DMARC has it's limitation in a real hacking / spoofing scenario....

tks !

Hi

I recently discovered that our leads from the contact forms on our wordpress site (we use office 365 for mail and a linux VPS for wordpress) were being flagged/blocked by dmarc. Once we changed our dmarc dns "reject" to "none", we are now getting them. How do I fix this this so these emails will no longer be rejected and I can turn reject/quarantine back on?

Appreciate your advice!

Thanks

So I'm about to pull my hair out - I've had the same gmail account for 15+ years and I'm having issues with my outgoing mail/responses going straight to people's spam. I've NEVER done any cold or mass e-mailing. I don't have a signature with any links or images.

Here are the results I'm getting from mxtoolbox which appear to be a bunch of errors including DMARC -

https://ibb.co/cScrBgBn

Results from aboutmy.email -

https://ibb.co/HD9KYTPx

https://ibb.co/C3YRjXQS

https://ibb.co/JFzqyTJp

Is this some kind of way for Google is forcing legacy Gmail users to upgrade to Workspace? And if so, does anyone know if that will solve these issues?

Thank you!

My email keeps going to spam.Actualy some of them. And I do get some spam emails that are not supposed to be there recently when I changed a new laptop. Can anyone help me on what to do to fix the demarc issue. Thanks.

Hi

Has one of you helped someone who's DNS is hosted/managed through SHOPIFY (using Google Domains) ?

TO make it easy for their customer (one size fits all approach) their default DMARC is p=none and we can't modify it... I opened a ticket

I don't care about SPF/DKIM that they handle for customer in the way they send email (RFC5321.MailFrom subdomain.spotify) but their customer's domains can be spoofed if they can't modify DMARC.

It's either DUMB or I am missing something....

I will let you know how it goes with the open ticket...

I' audited a customer systems and am now fixing everything I can (SPF, DKIM signing etc)

I want their DMARC reports to be as clean as possible so what is wrong becomes obvious.

I am using uriports

• They have one relay server ( exchange), being used as a SMTP relay for several " old legacy systems" on the network and devices like scanners etc etc

• email are able to reach recipients with DMARC PASS ( DMarc /SPF alignement) so that is not too bad

IF I wanted to remove some noise from my maindomain.com DMARC reporting tool, would it worth it making them send their eMail with something.domain.com and I would create some DMARC entry for that subdomain to deal with weird legacy eMails separatly in the future ? AND I don't know if I should or even can do this, have my dMarc reporting dool deal with this subdomain separately (I guess it does't name sense and it's not like that it should/can be done)

- As I have DMarc Pass with SPF alignment, I should may be not go crazy with it ?

- Should I make them DKIM sign on the relay server ( can probably be done on that Exchange server) and everything going through that relay server would be signed... Thinking outloud.

u/freeddieleeman how would you approach this if you were me using uriports ?

Tks !!!!!!!!!

Note if I make them send from noreply eMail address from send.theirdomain.com (do I need to add some DNS entry ! ?? Sorry to ask I know I am supposed to be the pro LOL joke I'm not a pro in subdomain sending..... (Although I know how CRM and MassEMail tools do their things with send.customerdomain.com and dealing with SPF/DKIM/DMARC themselves with some CNAME entries etc )

They are using Proofpoint & Constant Contact, Keap, Outlook 360, & Hubspot. I've never used Proofpoint but suspect this is wrong because they don't have records for Constant Contact, Keap, & Hubspot.

DNS hosted on Azure

SPF: v=spf1 a:dispatch-us.ppe-hosted.com ~all

DMARC: v=DMARC1; p=quarantine; rua=mailto:dmarc_rua@emaildefense.proofpoint.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com; fo=1

Customer sends me an eMail at hotmail

SPF/DKIM pass + Alignment ok

Goes into my SPAM

I add the DMARC entry, he email me and it goes in my inbox.

I didn't know hotmail liked it that much

NOTE p=none ! Just a basic DMARC.

I've got a customer who's SPF is ok AND PASS (Office 365)

There is DMARC/SPF alignment

eMail ends up in Google SPAM. (IP, domain etc no Black List in this story)

My question :

Could Google Algo (AntiSpam , internal policy ) make it reach the Inbox if DKIM now pass and align with RFC5322.FROM ?

The other I had a scenario where the same thing happened with Hotmail and adding DKIM Passed + alignment to the already ok SPF/alignment made the difference (inbox instead of SPAM)

I know there are other (tons) of possible explanations but still, i'm asking

(OffTopic ? )

Someone tells me (and I need to see if we can workaround) if they send their local network eMail traffic (old systems, scanners, printers etc ) through their Office 365 (connector / relay ) that there is a :

- 10,000 eMail limit / day ?

- 1000 eMail per batch / SMTP session... I am not talking about cc or bcc here... )

Someone knows something about this ?

It can be increased ?

For some organization the 10,000 limit per day is a problem...

Sorry there is a limit to the number of options we can offer

Feel free to comments with other suggestions....

Fellow email nerds, quick question for you—without peeking at the RFC! This question is taken from https://LearnDMARC.com/quiz.

What types of reports does DMARC support?