DMARC has been public since 2012 but most company domains still don't enforce it

Original Article ↗ Hacker News Discussion ↗

Despite being a standard since 2012, the DMARC email authentication protocol is still not enforced by most domains, leaving room for spoofed sender addresses and impersonation attacks. Commenters describe how DMARC, combined with SPF and DKIM, can reduce backscatter and improve sender identity verification, but also highlight operational complexity, poor tooling, misconfigurations at even large companies, and limited impact on spam that already passes authentication. Many note that big email providers’ opaque reputation systems and indifference to abuse reports now pose a larger obstacle to reliable, user-trustworthy email than missing DMARC records alone.

What DMARC Adds Beyond SPF/DKIM

  • Multiple comments explain DMARC as a policy and alignment layer on top of SPF/DKIM: it tells receivers what to do when checks fail (none/quarantine/reject) and ensures the visible “From” aligns with authenticated domains.
  • Benefits cited:
    • Reduces spoofing and backscatter (e.g., fewer bogus bounces and OOO replies).
    • Makes impersonation of major brands and well-configured domains harder.
    • Some providers allegedly treat domains with enforcing DMARC more favorably for inbox placement; others are skeptical.

Practical Challenges and Misconfigurations

  • Many small orgs and individuals lack time and expertise; DNS is often copy-paste with example p=none records left unchanged.
  • DMARC is described as simple in theory but tricky in practice (subdomains, multiple senders, forwarding, marketing tools).
  • Misconfigurations are common even at large companies; some admins ignore SPF/DKIM/DMARC failures to avoid losing customer mail.
  • Others refuse to whitelist and instead push remote IT to fix their setups, with mixed success and significant frustration.

Reports and Tooling

  • Aggregate DMARC reports (RUA) are seen as noisy or useless by some, especially when all mail is from a single server.
  • Others use tooling or custom scripts to parse reports and verify all sending services are configured.
  • Several commenters report using LLMs or online tools to analyze DNS/DMARC configuration and even automate changes.

Effectiveness Against Spam and Abuse

  • Strong disagreement on value:
    • Pro: DMARC “solves” identification (who really sent this), which is a prerequisite for other defenses; it stops direct domain spoofing.
    • Con: Most spam and phishing now passes SPF/DKIM/DMARC via big providers or SaaS; DMARC does little for user trust, content still drives filtering.
  • Some argue DMARC is noise that blocks legitimate mail when people misconfigure systems or rotate keys badly.

Broader Email Ecosystem Issues

  • Complaints that big providers ignore abuse reports yet dominate spam volume and reputation systems.
  • Self-hosters, especially low-volume senders, report good configuration but poor deliverability due to IP reputation and volume heuristics.
  • Some propose community/federated email or even a new protocol with built-in encryption and identity; others see this as impractical given current usage.