5
1

Reject mail that does not have a DMARC policy enabled

1y 21d ago by aussie.zone/u/maniacalmanicmania in austech@aussie.zone

I'm crossposting this in case any locals know how to do this. I'm at a loss.

cross-posted from: https://aussie.zone/post/21115161

How can I reject mail that does not have a DMARC policy enabled? Using Postfix 3.6.4 and OpenDMARC 1.4.2.

Some points:

  1. Many companies still send email without DMARC policies in their DNS. You'd be throwing away emails you ought to read.
  2. Why just no DMARC? Why aren't you also wanting to toss DMARC policies of p=none? What's the difference between, "I don't care, so I didn't set up a DMARC policy" and "I set up a DMARC policy so people stop complaining, but I turned it off because I don't care?" The result, for you, is identical. Spoofed emails will get delivered.
  3. A policy of p=quarantine is almost as bad. So spoofed email ends up in the spam folder along with a bunch of email that isn't a problem. We've been trained to not trust spam folders.
  4. If it isn't a policy of "reject" the email just can't be trusted is the bottom line.
  5. A lot of spam comes in from domains with a DMARC policy, even with a reject policy because the email passes the SPF check because it came from either their own email server or a compromised one or passes DKIM checks.

Your idea of tossing email without DMARC will not give you the results you hope for. You'll miss important emails, and you'll still get a steady flow of spam.

BTW, an extremely well-known cybersecurity expert's newsletter (Brian Krebs) goes out from a domain that is missing a DMARC policy! This just shows how not used it is.

I have checks in my email client and I put red tags on emails that aren't p=reject or that fail SPF or DKIM checks, so I'm extra careful. This is better than just tossing email with no DMARC policy.

I know this doesn't answer your question, but maybe you should think about whether you really want to do this.