Mastodawn

Meysam 19h ago

30.4% adoption vs. 12.8% enforcement: the DMARC gap

of 5.5M domains I scanned, 30.4% have a DMARC record

only 12.8% are at p=quarantine or p=reject

that means 57.9% of domains "doing DMARC" aren't actually enforcing it

they're collecting reports they probably aren't reading, some aren't even monitoring it at all!

a DMARC record at p=none is a monitoring declaration, not a security control

https://dmarcguard.io/research/email-authentication/

#DMARC #EmailSecurity #CyberResearch

Email Authentication 2026: DMARC Adoption Rate & SPF Statistics | DMARCguard

DMARC adoption at 30.4% across 5.5 million domains. Original research study analyzing SPF, DKIM, MTA-STS, BIMI, and DANE adoption across the full Tranco list.

DMARCguard

Meysam 1d ago

RFC 6376 doesn't mandate rotation frequency, but best practice is every 6-12 months

unlike passwords, DKIM keys don't get brute-forced

they get extracted from breached servers or leaked configs

rotation limits the blast radius

the process:

1. publish new selector
2. update ESP signing config
3. verify via DMARC reports
4. remove old selector after TTL expiry

DMARCguard flags selectors that haven't rotated in 12+ months

https://dmarcguard.io/learn/dkim/

#DMARC #EmailSecurity #DKIM

DKIM Authentication Guide [2026] | DMARCguard

DKIM adds cryptographic signatures to emails, verifying sender identity and message integrity. Learn how it works, record examples, and key rotation.

DMARCguard

Meysam 2d ago

NIS2 + DANE: the compliance angle nobody's discussing

NIS2 requires "appropriate and proportionate" measures for network and information system security, including encryption in transit

DANE (RFC 7672) provides cryptographic verification that your mail server's TLS certificate is authentic

for organizations in-scope for NIS2, DANE isn't optional hardening

It's a defensible technical measure for transport security

https://dmarcguard.io/learn/dane/

#DMARC #EmailSecurity #NIS2 #DANE

DANE & TLSA Records Guide [2026] | DMARCguard

Learn how DANE and TLSA records use DNSSEC to authenticate mail servers. Covers RFC 6698, TLSA configuration, DANE vs MTA-STS, and SMTP security setup.

DMARCguard

Meysam 3d ago

thank you to everyone who's tested the tools

thousands of domain checks through our free tools in the past few weeks

every check that surfaces a misconfigured SPF record or a missing DMARC policy is a small win

some of you have emailed me directly with questions

if you've been using the tools and found value, I'd genuinely appreciate you sharing them with a colleague who manages domains

https://dmarcguard.io/tools/

#DMARC #EmailSecurity #BootstrappedStartup #Community

Free Email Security Tools | DMARCguard

46 free email security tools — DNS checkers, generators, and report analyzers for DMARC, SPF, DKIM, and more. All client-side.

DMARCguard

Shameful 3d ago

Top malicious IPs observed on 2026-06-18

#infosec #spam #spoof #emailsecurity

46.151.182.137 Intelligence Report — DMARC Spoofing Activity & Network Analysis | Sh4meful

Intelligence report on 46.151.182.137: DMARC spoofing activity, network ownership, geolocation data. Track email security threats and investigate suspicious IPs. Free threat intelligence.

Shameful 3d ago

Top malicious IPs observed on 2026-06-17

#infosec #spam #spoof #emailsecurity

203.189.159.206 Intelligence Report — DMARC Spoofing Activity & Network Analysis | Sh4meful

Intelligence report on 203.189.159.206: DMARC spoofing activity, network ownership, geolocation data. Track email security threats and investigate suspicious IPs. Free threat intelligence.

Shameful 3d ago

Top malicious IPs observed on 2026-06-16

#infosec #spam #spoof #emailsecurity

34.78.248.165 Intelligence Report — DMARC Spoofing Activity & Network Analysis | Sh4meful

Intelligence report on 34.78.248.165: DMARC spoofing activity, network ownership, geolocation data. Track email security threats and investigate suspicious IPs. Free threat intelligence.

Shameful 3d ago

Top malicious IPs observed on 2026-06-15

#infosec #spam #spoof #emailsecurity

85.113.33.198 Intelligence Report — DMARC Spoofing Activity & Network Analysis | Sh4meful

Intelligence report on 85.113.33.198: DMARC spoofing activity, network ownership, geolocation data. Track email security threats and investigate suspicious IPs. Free threat intelligence.

Meysam 4d ago

domains with SPF+DKIM+DMARC at enforcement see 2.7x better inbox delivery compared to unauthenticated domains

this number is aggregated across deliverability studies and consistent with what I see in report data

mailbox providers use authentication signals in their spam scoring

full auth doesn't guarantee the inbox, but missing auth almost guarantees the spam folder

https://dmarcguard.io/tools/domain-health-check/

#DMARC #EmailSecurity #EmailDeliverability #InboxPlacement

Domain Email Health Check | DMARCguard

Run a comprehensive email authentication audit across all protocols. Get a weighted security score and actionable recommendations -- entirely from your browser.

DMARCguard