The DMARC Report

Can the name be forged?

The DMARC policy of the name itself tells receivers what to do with mail that claims it and cannot prove it. Of the 56 that can be forged, 53 also have a registered lookalike that can send mail: DMARC protects the exact name, and never sees the copies.

• Reject: refused 54
• Quarantine: spam folder 14
• None: delivered 14
• No record 18

0 apply the policy to only part of the mail · 10 let a name under them off more lightly · 8 send no mail and say so

How much they allow

The Top 100 authorize a median of 1,798 IPv4 addresses to send as them, on 1 name with an SPF record of its own. The mean is 143 thousand, pulled up by the shared clouds a few of them allow whole.

43 send from more than one name, each with its own SPF. 19 could not be counted: their records use macros, pass the limit of ten lookups, or name a record that does not answer.

How they keep SPF

The senders they name

A service is counted where a domain's SPF includes it, where we found its DKIM key, or where it runs the mail hosts. A record can name a service no longer used.

39 publish a DKIM key we can find; 29 use RSA 1024.

We look for keys under the selectors of the services each domain names, so the key counts are a floor.

Where the reports go

Your own mailbox 16 (16%) · Valimail 8 (8%) · Fortra Agari 8 (8%) · dmarcian 4 (4%) · Proofpoint 2 (2%) · DMARC Digests 1 (1%) · Mimecast DMARC Analyzer 1 (1%) · none 42

16 of the 30 that publish a DMARC record on more than one name send the reports of every name to the same place.

Transport

MTA-STS enforce 4, testing 4 · TLS-RPT 10 · BIMI 0

MTA-STS asks senders to deliver over encryption only; TLS-RPT asks for reports when they cannot; BIMI shows a logo beside mail that passes DMARC at enforcement.

Every domain

What these numbers do not say

They are what each domain publishes, not what its mail does. A domain can name a sender it no longer uses, and sign with a key we did not find. The names under a domain come from certificate logs and the common names we try, up to fifty a domain.