Unable to send mail from forum.

[Douglas]

Arantor, I had to reconfigure *several* domains that don't bulk send, but still had their emails land in the spam box, until I corrected SPF, DKIM and DMARC. Once I did that, those emails no longer landed in the spam box. I've done over 60 domains, so far, and counting.

(This is for my day job, FYI.)

FYI, we don't wade through DMARC any further. Our DMARC record is set to "v=DMARC1; p=none; fo=1", which Google and Yahoo are quite fine with, shockingly.

[Arantor]

*shrug* Your experiences and mine differ. I'm just going off what was actually reported in the trade press and how that relates to my experience. Mailgun does not request DMARC records though, and no issues here (they do ask for SPF, DKIM and valid MX records which in practice will get you through a lot of cases, and interestingly few people talk about valid MX records as a sensible requirement)

As for that policy being fine, sure, the requirement is that you have a policy, not that it is a sane or good one.

A policy of take no action but receive reports on failing SPF or DKIM is considered a safe policy though, because it shows that you're at least looking at it. fo=1 is generally seen as a good starting point for dipping your toes in the pond.

[shawnb61]

DMARC is very easy to configure, & I certainly don't want other people to be able to send mail claiming they are representing my forum. 

Why leave that wide open, when it's so easy to fix?  I'd suggest everyone go for p=reject. 

p=none works as an acceptable first step in the recent Yahoo/Google changes.  But their ultimate goal is to get everyone to go for p=reject.  So it's coming...

This might surprise you.... In 2024, Gmail and Yahoo are only requiring that senders implement a DMARC policy of p=none. Why wouldn't they push things further you ask? Good question.

The truth is, this requirement is only the first step. At this point, mailbox providers just want more senders to start implementing DMARC. Once those records are in place, it is very likely that more new requirements will emerge that require a policy of either p=quarantine or p=reject (at least for bulk email senders).

In a webinar with Sinch Mailgun, Marcel Becker of Yahoo confirmed this approach saying:
    "The end goal is ideally a policy of p=reject. That's what DMARC is for. Ensuring that your domain cannot be spoofed and protecting our mutual customers from abuse."
    Marcel Becker, Senior Director of Product at Yahoo

Source: https://www.emailonacid.com/blog/article/email-deliverability/why-strong-dmarc-policy/

DMARC prevents others from pretending to be you:
https://thehackernews.com/2021/09/how-does-dmarc-prevent-phishing.html

[Arantor]

If SPF fails, it's because someone is trying to send an email for your domain that isn't in the list of sources you've configured. Don't need DMARC for that.

If DKIM fails it's because the email wasn't signed using the public key attached to the domain (or, in the case of someone like Mailgun, it's the key they give you that they're going to sign on your behalf), and again you don't need DMARC for that.

On the other hand, I did so enjoy reading the thousands of reports I got every month that did fail DMARC for entirely spurious reasons, on fo=1.

-sigh- time to go back under my rock I guess.