22 RFCs and counting

DMARCguard references 22 RFCs across its protocol implementations

not as marketing decoration, but as implementation guidance

when I started building the SPF flattener, I re-read RFC 7208 three times to get the macro expansion edge cases right

the ARC chain validator follows RFC 8617 to the letter on seal validation ordering

https://dmarcguard.io/tools/

#DMARC #EmailSecurity #RFC #BootstrappedStartup #Engineering

DKIM alignment: the failure nobody catches

for DMARC to pass via DKIM, the `d=` domain must align with the `From` header domain

this is the #1 misconfiguration I see in DMARC reports

the fix: configure your ESP to sign with your custom domain

in most ESPs, this means adding a CNAME for `{selector}._domainkey.yourdomain.com` pointing to their signing infrastructure

https://dmarcguard.io/blog/dkim-alignment-failure-fix/

#DMARC #DKIM #EmailSecurity #EmailAuthentication #RFC6376

NIS2 Directive and email transport encryption

DANE (DNS-Based Authentication of Named Entities, RFC 7672) binds your mail server's TLS certificate to DNS via TLSA records, protected by DNSSEC

combined with MTA-STS for non-DNSSEC domains, you cover both enforcement models

DMARCguard monitors both protocols because compliance requires proving ongoing enforcement, not just initial deployment

https://dmarcguard.io/tools/dane-checker/

#DMARC #EmailSecurity #NIS2 #DANE #EUCompliance

Saturday DMARC tip: check your subdomains

your main domain might be at p=reject

but what about mail.yourdomain.com?

or marketing.yourdomain.com?

DMARC policies automatically cascade to subdomains (but not all MTA providers respect it!)

you are strongly recommended to explicitly set `sp=reject` in your organizational domain's record

without it, every subdomain inherits p=none by default

https://dmarcguard.io/tools/dmarc-checker/

#DMARC #EmailSecurity #DNSTips #SecurityTip

Viele denken bei #DMARC und #E-Mail-Sicherheit an graue Theorie. Mein Dashboard zeigt gerade die Realität:

Spam-Bots aus aller Welt (Kasachstan, China, Russland etc.) versuchen im Namen meiner Domain Mails zu versenden.

Wer seine Domain noch auf p=none (nur mitlesen) oder gar kein DMARC hat: Ändert das! Es ist der beste Türsteher, den eure Domain haben kann.

$199/month for 8 domains and 5 protocols

I was pricing out DMARC monitoring solutions before I decided to build my own.

one well-known vendor charges $199/month for 8 domains and covers 5 protocols.

another gutted their free tier entirely... zero domains at the free level now.

I built DMARCguard with a different model.

- free tier: 7 protocols, 2 domains
- Pro: 9 protocols, 10 domains, 10 members, $69/month.

https://dmarcguard.io/compare/

#DMARC #EmailSecurity

EasyDMARC Alternative: Why Teams Are Switching

EasyDMARC가 2023년 말부터 2024년 초 사이에 무료 플랜을 대폭 축소하고 가격을 인상하면서 SMB와 IT 팀 사용자들이 대안 도구를 찾고 있다. EasyDMARC는 ARC와 DANE/TLSA 같은 중요한 이메일 인증 프로토콜을 지원하지 않아 보안 측면에서 한계가 있다. 주요 대안으로는 DMARCguard, dmarcian, PowerDMARC가 있으며, DMARCguard는 가장 완전한 프로토콜 지원과 구체적인 문제 해결 가이드를 제공해 주목받고 있다. 가격과 프로토콜 지원, 데이터 마이그레이션 가능성 등을 고려해 조직에 맞는 도구 선택이 중요하다.

https://dmarcguard.io/blog/easydmarc-alternative/

#dmarc #emailsecurity #dmarchguard #dmarcian #powerdmarc

4.8% of domains have broken SPF records

across 5.5M domains scanned, 4.8% have SPF records with lookup errors

- exceeding the 10-mechanism limit
- circular includes
- syntax errors
- or void lookups

that's roughly 149,000 domains with SPF records that actively fail evaluation

their email authentication is worse than having no SPF at all, because a permerror result is treated differently than a "none" result by receiving MTAs

https://dmarcguard.io/tools/spf-checker/

#DMARC #SPF