30.4% adoption vs. 12.8% enforcement: the DMARC gap

of 5.5M domains I scanned, 30.4% have a DMARC record

only 12.8% are at p=quarantine or p=reject

that means 57.9% of domains "doing DMARC" aren't actually enforcing it

they're collecting reports they probably aren't reading, some aren't even monitoring it at all!

a DMARC record at p=none is a monitoring declaration, not a security control

https://dmarcguard.io/research/email-authentication/

#DMARC #EmailSecurity #CyberResearch

RFC 6376 doesn't mandate rotation frequency, but best practice is every 6-12 months

unlike passwords, DKIM keys don't get brute-forced

they get extracted from breached servers or leaked configs

rotation limits the blast radius

the process:

1. publish new selector
2. update ESP signing config
3. verify via DMARC reports
4. remove old selector after TTL expiry

DMARCguard flags selectors that haven't rotated in 12+ months

https://dmarcguard.io/learn/dkim/

#DMARC #EmailSecurity #DKIM

NIS2 + DANE: the compliance angle nobody's discussing

NIS2 requires "appropriate and proportionate" measures for network and information system security, including encryption in transit

DANE (RFC 7672) provides cryptographic verification that your mail server's TLS certificate is authentic

for organizations in-scope for NIS2, DANE isn't optional hardening

It's a defensible technical measure for transport security

https://dmarcguard.io/learn/dane/

#DMARC #EmailSecurity #NIS2 #DANE

DMARC is nu een officiële internetstandaard voor e-mailbeveiliging.

DMARC is een internetstandaard die helpt om phishing en e-mailspoofing tegen te gaan. Dit draagt bij aan een veiliger en betrouwbaarder internet.

De specificatie van DMARC werd in 2015 gepubliceerd als een Informational RFC. Nu is de standaard herzien en opnieuw gepubliceerd als een officiële IETF-standaard (DMARCbis).

Platformlid @SIDN / @SIDNlabs schreef er een nieuwsbericht over: https://www.sidn.nl/nieuws-en-blogs/dmarc-is-nu-een-officiele-internetstandaard-voor-e-mailbeveiliging

Op een later moment wordt de nieuwe DMARC-standaard ook geïmplementeerd in Internet.nl.

Wil je weten of DMARC voor jouw e-mail correct is ingesteld? Test het op Internet.nl en ontdek hoe je jouw e-mail nog veiliger kunt maken!

#dmarc #email #security #phishing #spoofing #ietf #internetstandards

thank you to everyone who's tested the tools

thousands of domain checks through our free tools in the past few weeks

every check that surfaces a misconfigured SPF record or a missing DMARC policy is a small win

some of you have emailed me directly with questions

if you've been using the tools and found value, I'd genuinely appreciate you sharing them with a colleague who manages domains

https://dmarcguard.io/tools/

#DMARC #EmailSecurity #BootstrappedStartup #Community

domains with SPF+DKIM+DMARC at enforcement see 2.7x better inbox delivery compared to unauthenticated domains

this number is aggregated across deliverability studies and consistent with what I see in report data

mailbox providers use authentication signals in their spam scoring

full auth doesn't guarantee the inbox, but missing auth almost guarantees the spam folder

https://dmarcguard.io/tools/domain-health-check/

#DMARC #EmailSecurity #EmailDeliverability #InboxPlacement

BIMI: your logo in the inbox, verified

DMARCguard BIMI checker validates your BIMI record, SVG format, and VMC certificate chain

getting your brand logo to appear next to your emails in Gmail and Apple Mail requires correct DMARC enforcement plus a verified mark certificate

the checker tells you where you stand

but BIMI records reference certificates that expire, and when they do, your logo disappears

https://dmarcguard.io/tools/bimi-checker/

#DMARC #EmailSecurity #BIMI #BrandProtection

Cloudflare DMARC Management is now generally available

https://blog.cloudflare.com/dmarc-management-ga/

#Security #Email #DMARC