On Sun, Sep 20, 2026 at 1:37 PM Defaults Mailbox via mailop < [email protected]> wrote:
> I run a census, across all domains I can find each month, and DMARC > adoption and subsequently enforcement, does, appear to be increasing, > albeit slowly. > *https://defaults.exposed/trends/dmarc-policy-mix* > <https://defaults.exposed/trends/dmarc-policy-mix> > SPF, DKIM, DMARC, it's all a bit "alphabet soup", and many system > administrators don't have the time to get into it and get it all setup > properly. I know of one financial institution, that spend a large 6 figure > sum on an external vendor to help them visualise their RUA reports and > still took 4 years to get to enforcement. And, all this time, "ze bad guys" > are spoofing their customers. And, then, security folks (I’m one of them), > wonder why “bad stuff” happens. > There's also a lot of "funny" items in the census data (well, I think they > are funny-ish.) > “*DMARC=v1*” - that's it, nothing else, apart from that > There are circumstances where a DMARC policy record containing "DMARC=v1" and nothing else is perfectly legitimate, namely when authorizing third parties to consume DMARC reports on behalf of the Domain Owner. See https://www.rfc-editor.org/info/rfc9990/#section-4 (and its predecessor, https://www.rfc-editor.org/info/rfc7489/#section-7.1) -- Todd
_______________________________________________ mailop mailing list [email protected] https://list.mailop.org/listinfo/mailop
