alt.hn

8/3/2026 at 9:29:46 AM

What DMARC Protects You From, and What It Does Not

https://senderledger.com/articles/what-dmarc-actually-protects-you-from

by adulion

8/3/2026 at 10:15:16 AM

> Every email carries two "from" addresses

I made a presentation about exactly the same subject many years ago, but I was not shy of separating the SMTP protocol (RFC 821 and the following ) and the email message (RFC 822 and the following).

It makes the link between SPF, DKIM and DMARC much clearer.

Anyway. The article covers just the bare minimum, and in the most obscure way.

For those interested in the inner workings of contemporary email delivery... I recommend the posts by Alex Shakhov on LinkedIn https://www.linkedin.com/in/alexshakhov/ (Yes, there is still meaningful content on LinkedIn, it's just vanishingly rare)

by sam_lowry_

8/3/2026 at 4:17:46 PM

If only I could read those articles without joining LinkedIn.

by ciupicri

8/3/2026 at 12:23:46 PM

Are those posts available without logging in? This sounds like good stuff but I can’t access it.

by philosopherNoob

8/3/2026 at 12:32:37 PM

I think he reposts them on his consulting page https://www.sh.consulting/blog and no, I am not affiliated. Just keeping an eye on the email deliverability topic as a hoppy.

by sam_lowry_

8/3/2026 at 2:43:51 PM

I'm sure I don't speak just for myself when I ask, can you link the presentation?

by ddevnyc

8/3/2026 at 3:50:57 PM

I can't share all of it, but to understand the relationship between SPF, DKIM and DMARC one should know that DMARC covers two possible cases. Either DKIM domain must match From: domain or MAIL FROM domain must match the From: domain plus the IP address of the sender should pass the SPF check

https://mikhailian.mova.org/delivering-mails/1.png shows the SMTP plaintext chat for the first case,

https://mikhailian.mova.org/delivering-mails/2.png shows the second.

by sam_lowry_

8/3/2026 at 10:55:27 AM

Vaguely related question: what is the go-to open DMARC check implementation these days? I mean the part that checks _received_ mail against DMARC rules. It used to be opendmarc, but it seems people have been dropping it for a while because of history of breaking changes and general lack of good stewardship [1]. Anyone using pydmarc [2]?

It's hard to find good info on this since 99% of search hits are people talking about setting up DMARC from the _sender_ side.

[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1014058#39

[2] https://pypi.org/project/dmarc/

by avian

8/3/2026 at 11:52:30 AM

I use rspamd.

This might be a little heavy if you’re solely looking for DMARC validation, but I use the other parts of rspamd as well for inbound email.

https://rspamd.com/modules/dmarc/

For a library, I mainly write Go and I use https://github.com/emersion/go-msgauth (formerly known as go-dkim).

by oogali

8/3/2026 at 12:50:12 PM

Url seems to be https://docs.rspamd.com/modules/dmarc/

by actionfromafar

8/3/2026 at 1:48:20 PM

Thanks for the correction. I guess I had a mis-paste that stripped out the leading part of the hostname... weird.

by oogali

8/3/2026 at 2:21:40 PM

This just brought back bad memories of websites manipulating the clipboard when copying text. The ones that append the website attribution with full URL is a crime against humanity.

by dylan604

8/3/2026 at 12:02:41 PM

Indeed opendmarc seems practically abandonware.

rspamd is what I use.

by 1over137

8/3/2026 at 1:22:45 PM

That is good to know. I thought it was maintained by Valimail?

by brightball

8/3/2026 at 2:34:30 PM

We use sendops.dev for that and the rest of reputation management on AWS.

by ksajadi

8/3/2026 at 11:52:08 AM

> Here is the part that trips people up.

It's hard to take something seriously when it's very clearly AI generated. It's just a coin toss on whether the information in the article is correct.

by joladev

8/3/2026 at 2:49:16 PM

Yeah. I know what DMARC does, I run a mail server, but I thought it might be an interesting blog post nonetheless. It was very very obviously generated text, and not particularly information-dense or insightful. Gave up on reading it halfway through.

by johncalvinyoung

8/3/2026 at 7:13:10 PM

> Where it falls short

Really? DMARC falls short there? "DMARC" now must run around beating any naughty sender that tries to send spoofed email with a stick? Because it already proves they're a spoofer (if domain owner was smart/important enough) to anyone who is looking :)

I had set the rules to reject the mail (if someone tried to spoof my personal domain; some do) and then send me a combined report. After realising I could do nothing with those reports, I just removed that part.

Anyway, one of the few reasons I still use Thunderbird is its DKIM Verifier add-on.

SMS and email, in their current design, have outlived their safety relevance by a long shot. At least email has some protections (or a lot), but SMS is just a time bomb that keeps getting used even though it keeps going off.

by crossroadsguy

8/3/2026 at 6:33:08 PM

Bad article, probably a bad product.

by thesuitonym

8/3/2026 at 6:34:40 PM

Can you elaborate more on why it's a bad article?

Is someone who doesn't know much about it? It seem to make a lot of sense to me and was really easy to understand and digest.. is there something inaccurate about it though?

by ElijahLynn

8/3/2026 at 5:05:12 PM

protests you from: having some free time for more important things

doesn't protect you from: anything, users will get phished by domain anyway, and the spammers/scammer send DMARCed email anyway

by PunchyHamster

8/3/2026 at 6:30:30 PM

I'm not sure why you think DMARC takes a lot of time to manage. It doesn't. Are you trying to read every single RUA report daily?

by thesuitonym

8/3/2026 at 5:40:21 PM

dmarc

by sourcecodeplz

8/3/2026 at 11:05:55 AM

I think DMARC is missing email address with IPv[46] literals support. As being self-hosted, without paying the DNS mob, I am still blocked to send email to gmail.com because such email addresses do throw out of whack gogol code.

Email addresses with IPv[46] literals are intrinsincly stronger than SPF. If in the envelope or any of the 'from' headers (if my memory does not fail me, there are few more headers to scan), the IPv[46] literal does not match the actual and real IP of the SMTP server, the email is dropped, not even going into any spam folder.

Conspiracy mode: they know and are careful not to support that, in order to create a walled garden of internet messaging for them and their friends.

by sylware

8/3/2026 at 9:39:23 PM

I think DMARC is missing support for homing pigeon characteristics such as the markings and colors on its crest and plumage. As being self-hosted, without paying the IANA and ISP mob, I am still blocked to send email to gmail.com.

by drdexebtjl

8/3/2026 at 2:00:32 PM

Arguably, missing IP literal domain support is pretty far down the list of things creating today's actual mail delivery walled garden.

by lxgr

8/3/2026 at 11:47:07 AM

Wasn't this removed from the email standards?

by inigyou

8/3/2026 at 3:01:41 PM

It is not a conspiracy theory that it is hard to maintain reliable delivery with self-hosting email. It is primarily because email filters are in part based on trust relationships, and huge amounts of spam come (or at least, did) from relatively unknown originating servers.

by kube-system

8/3/2026 at 5:06:24 PM

Most people don't own their IP range so it's moot point to support it.

by PunchyHamster

8/3/2026 at 2:06:18 PM

[flagged]

by ShieldScopeApp

8/3/2026 at 12:48:00 PM

[dead]

by effnorwood

8/3/2026 at 10:11:47 AM

[flagged]

by cadamsdotcom

8/3/2026 at 10:38:19 AM

> it's rude to ship your first draft

To whom this should concern:

Oh, do pop off.

Bothering to write/edit anything yourself should be given bonus points these days, not pulled apart for minor grammar/structural/style issues. You'll be telling me no to flaming split initiatives next.

by dspillett

8/3/2026 at 11:16:55 AM

You’re being polite, this stinks of Claude.

by iamacyborg