We've done something slightly different (because it's data we have to hand) but I think it's still comparable.
We looked at the all messages sent from ncsc.gov.uk in March 2019. In total, we sent 67,962 emails and received DMARC reports for 8,657 emails, about 12.5%. Now, I think our main correspondents are likely to be in gov.uk and we know there's a lot of Office 365 and older on-prem solutions that don't report, so it's going to be artificially low. Possibly more interesting is the data from the Gov.UK Notify service, which sends mail from the notifications.service.gov.uk domain. Notify is the platform for government to send notifications to people and it publishes its performance data, for example for March 2019 at https://www.gov.uk/performance/govuk-notify/notifications-by-type#from=2019-03-01T00:00:00Z&to=2019-03-01T00:00:00Z This shows that Notify sent 36,301,537 emails in March and we received reporting of 13,671,108 emails, about 37.9%. Notify sends messages to a much broader set of receivers so is likely to be more representative and therefore useful statistically. <hint mode='subtle'> I'd be really interested in what happens to these numbers if Microsoft start sending DMARC reports, for both O365 and their consumer platforms. </hint> Ta. I. -- Dr Ian Levy Technical Director National Cyber Security Centre [email protected] Staff Officer : Kate Atkins, [email protected] (I work stupid hours and weird times - that doesn't mean you have to. If this arrives outside your normal working hours, don't feel compelled to respond immediately!) -----Original Message----- From: dmarc <[email protected]> On Behalf Of Scott Kitterman Sent: 13 April 2019 22:12 To: [email protected] Subject: [dmarc-ietf] DMARC Coverage A couple of days ago I sent a single message to a reasonably large mailing list (spf-help, email oriented - so likely not representative, but it's a data point). Since I am a list owner, I know how many subscribers there are and from my DMARC feedback, I know how many times that single message got reported. 43% of them showed up in my DMARC feedback, so that's at least one data point on breadth of coverage for DMARC feedback. To do this (at least the way I did it), you need to send a single message in a reporting period to an email list that does not re-write from and for which you know how many subscribers there are. I'm curious what kind of numbers other might be able to come up with. Scott K _______________________________________________ dmarc mailing list [email protected] https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fdmarc&data=02%7C01%7Cian.levy%40ncsc.gov.uk%7C14b11e326d154e893be508d6c054c2b9%7C14aa5744ece1474ea2d734f46dda64a1%7C0%7C0%7C636907867621729087&sdata=cpa%2BmnPs5ClQ1ruPwExr6qwOfqzpb1WWkJUwm4%2B5p7M%3D&reserved=0 This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation. Refer any FOIA queries to [email protected] _______________________________________________ dmarc mailing list [email protected] https://www.ietf.org/mailman/listinfo/dmarc
