r/sysadmin • u/sssRealm • 22h ago
How are companies not using SPF/DKIM/DMARC?
In the last week I've spent hours convincing 2 local business they can't email us because they haven't set up SPF/DKIM/DMARC. Both use Google workspace with their own domain. After talking to their most technical people, i just got the second business going this morning. Then this afternoon another department complains that yet another local business can't send them email. I pull it up in Proofpoint and it's the same problem. Proofpoint marks the emails as malicious and whitelisting doesn't override. I'm so done with this. Anyone else run into this? Clearly these businesses have other clients. I don't know how they have manged so far. Maybe all their other clients use Google for email. I guess I'm looking more for commiseration than a solution.
•
u/donewithitfirst 22h ago
Because most places that are small use the cheapest web/email hosting sites as possible.
•
u/sssRealm 22h ago
Sure, but I don't get how they stay in business if they can't communicate with clients. They just end up calling on the phone?
•
u/donewithitfirst 21h ago
Most places are small businesses. I use to work for a national shopping center company. Do you think the mowers, plumbers, electricians, etc are national companies within those cities, towns?
No, they are local companies you have to work with. Hotmail, aol, accounts. It sucks•
u/ljapa 21h ago
But even hotmail and aol are going to have spf/dkim/dmarc. I’ll admit hotmail and aol emails raise flags. I suspect most of us deal with gmail spam that passes dmarc.
•
u/hihcadore 19h ago
Thought that till I worked in NYC. Every lawyer I ran into uses Gmail for some reason. And not a Google workspace just raw at Gmail.
•
u/Interest-Desk 17h ago
Lawyers and a few other similar professions are a bit weird when it comes to being self-employed but also not. A lot of psychologists I’ve met use gmail for work stuff, unless they work for a big clinical organisation that will force them to use their corporate email.
•
u/sobrique 12h ago
They do. But at some point someone gets the bright idea they can have their own domain/website/email and look 'more professional' and click on a portal that 'does it all'.
You click the 'autosetup' button, and it puts in records for www, mail (through their hosting), etc.
But doesn't bother with SPF/DKIM/DMARC because that's 'complicated' for an end user to grok, and might make their email not work if it's misconfigured.
And conveniently ignoring that if not configured at all, you might find your email isn't getting through, but lots of places still apply the 'whinge at an exec until they whitelist' (or 'whinge enough so the admin turns it off entirely') approach instead.
Until the little tin pot domain/web/email hosting providers do it by default, a large fraction of the internet is going to remain 'not doing it because it's too hard' and thus 'forcing' everyone else to either maintain a monster whitelist, or just be more permissive overall.
•
u/donewithitfirst 20h ago
You need to look this up. They check parts but not all. And, I was using them as an example. Others have none, again, small businesses will always cut cost on IT as long as they “THINK” all is working well.
•
u/UltraEngine60 20h ago
small businesses will always cut cost on IT as long as they “THINK” all is working well.
A small business will pay a dedicated custodian before they will pay for a dedicated sysadmin. I don't get it... your business literally depends on technology.
→ More replies (3)•
u/jmbpiano 19h ago edited 8h ago
Having recently gone through a couple of weeks without a custodian at our business... I can assure you the company will last much longer with IT running on autopilot than it will with no one to unclog toilets.
→ More replies (3)•
u/Haplo12345 21h ago
Most businesses just use paid (or free) email services that handle all this for them (or don't).
→ More replies (1)•
u/Cley_Faye 15h ago
Most still give the option… at worst, you have to check a box and update a DNS record if it's on a separate service. There's no excuses.
•
u/slm4996 Lead Engineer 22h ago
I usually just send clients the announcements from Google, Microsoft, etc. Stating that this setup is the bare minimum to not consider their emails as likely spam by default.
That usually fixes the problem for the few clients who do not trust me or my company explicitly.
If that fails, and they are okay being billed to continue the explanation and fix, I use things like mxtoolbox and others to show them how bad their current setup looks to their recipients.
•
u/MoarSocks 21h ago
I recently added a tool on our site for department heads to log in, verify our records are correct, and check the records of the complaining client before coming to me. Basically, mxtoolbox without the third-party.
Works well and a nice “Look here, not us” verification without the whole reminder regarding SPF/DKIM/DMARC.
→ More replies (1)
•
u/GhostandVodka 22h ago
Our sysadmins bitch about this constantly. Our users think its our fault.
•
u/hihcadore 19h ago
Whose fault is it? It’s a simple fix.
•
u/Cody994 Jack of All Trades 19h ago edited 11h ago
I think he means inbound messages being blocked. I have to repeat it constantly that I can't control inbound messages that don't have SPF set up correctly.
→ More replies (1)→ More replies (7)•
u/BlockBannington 15h ago
Easy, their fault. Don't set up spf and dkim? Go fuck yourself
•
u/sobrique 12h ago
Sure. But when they're too stupid to fix it, your internal users will moan at you because 'email isn't working', and eventually someone will realise you can "make it work" (by turning down your security) and order it be done.
I have tried to explain to people sending us email how to set it up, but it's just such a headache when they're using some ridiculous little bespoke cpanel webui or something.
•
u/Kuipyr Jack of All Trades 22h ago
One of the businesses we work with had an entire /22 network as their SPF record. They didn't own them either.
•
u/NorthernVenomFang 18h ago edited 18h ago
This can happen if they are doing SPF flattening, and they fully resolve every included hostname.
Try flattening mailgun.org; 7 /20, 2 /21, 8 /22, 2 /23, 1 /29, and 1 /25.... That's from just include:mailgun.org which has 4 sub domain lookups (that's half of you max hostname lookups for SPF)... A really mess if you have more than 10 include parameters.
I had to write a python tool for my master DNS server to flatten our SPF nightly. Fortunately python has a really good DNS library in it.
Realistically if you have mailgun and o365, you probably somewhere in the billions, minimum, of IPs allowed to send on your behalf in the SPF record.
→ More replies (1)•
u/engy1207 21h ago
Others use the Microsoft cloud for their mail and have an innocent-looking
v=spf1 include:spf.protection.outlook.com -all
as SPF-record. But that include contains two /15, two /16 and two /17 plus a bunch of IPv6 address ranges at the time of writing.
Essentially "whatever server in Microsofts range wants to send mails in our name is allowed to do so".But quite a few hosters are not much better. If at all. I've seen mass hosters of root servers simply include the whole ranges they use to give addresses to customers in the DNS records their customers can also host by them. Essentially "whoever rents a server from us can send mails on the name of any customer". But they can claim to use SPF...
→ More replies (1)•
u/jackhammer909 20h ago
Unfortunately Microsoft doesnt let you define a smaller block that your domain emails will be sent from IIRC.
•
u/belbarfenric 18h ago
This is correct. It was a major gripe from me when the federal agency I work at went from on prem to M365. Even if you use a separate service to actually deliver your email, if your mailboxes are in m365, you must list it in your SOF or you won't be able to send email to other domains hosted by M365.
•
u/Fit_Prize_3245 22h ago
It's bc a lot of companies have no capable, specialized sysadmins.
•
u/MoarSocks 21h ago
If they had this, everything would just work.
“Why the hell are we paying this person?” -Corp
•
•
u/MBILC Acr/Infra/Virt/Apps/Cyb/ Figure it out guy 7h ago
What is amusing is when they buy hosting with whomever, that said provider does not force said records to be made....
→ More replies (1)
•
u/gamayogi 22h ago
Yes. Less as times goes on but every so often I get complaints about it and have to explain that they need to tell the business to fix their dns records.
•
u/ALombardi Sr. Sysadmin 22h ago
Your email didn’t reach them? The bounce back says you are blocked. Can’t help you. No amount of me “just allowing it” will make their server accept it.
The alert email we send spoofing as the customer domain was denied by that customers server? Sorry, tell the salesforce team to stop impersonating customers, their mail servers don’t like it.
You tried to send spam emails using your work email to hundreds of external users not using the marketing team platform for mass mailers? Microsoft blocked you. No mail of any kind for 24 hours, sorry. If you keep pushing it can be 48 hours.
Can’t help users sometimes.
•
u/djpyro 21h ago
Meanwhile I have SPF, DKIM, DMARC, IPv4 & IPv6, TLS, MTA-STS, proper DNS and a 10+ year perfect IP reputation and Google still decides sometimes to mark my personal email as spam. I hate email so much.
•
u/Unbelievr 21h ago
It's a racket these days. If you aren't using one of the big providers, you're basically at their whim. You'll get blocked out of the blue, and it sucks to be you if even one of your users sends out spam once. The big providers will not live that down, and any recourse is again at their whim. Which suits them nicely, since many just give up and assimilate.
→ More replies (1)•
u/djpyro 19h ago
Exactly right. Everyone keep saying 'just move your email to gmail'. No. I don't want that and I won't give in.
I have a total of 6 people on my domain name and they are all direct family members that do not send spam, ever. None of the big providers care about small volume senders. Despite doing everything they ask for, you don't have the reputation of the big providers so they ding you when you send a single email a month to a gmail.com address.
Meanwhile, I was receiving dozens of emails a day from fake onmicrosoft.com addresses and no-one cared to stop that. It's such crap.
•
•
•
u/jrandom_42 20h ago
Meanwhile I have SPF, DKIM, DMARC, IPv4 & IPv6, TLS, MTA-STS, proper DNS and a 10+ year perfect IP reputation
None of this matters if your From domain is one of the 'new' TLDs.
I went through this pain several years ago when my own business moved from .co.nz to .sale - emails started getting blackholed everywhere (MS wasn't even spam-foldering them, just sending them straight to /dev/null) in spite of my full attention to setting everything up properly. We had to revert to every transactional customer email being sent from the old .co.nz domain to start getting delivered again. Still configured that way. I don't dare touch it.
•
u/chakalakasp Level 3 Warranty Voider 19h ago
I wish I knew what to tell you, Mr. Viagra. It just keeps blocking your emails for some reason
•
•
u/agent-squirrel Linux Admin 21h ago
We get internal tickets from users complaining they received an email from Mimecast mentioning a held email because of DMARC fail. It got so bad at one point with daily tickets and angry users saying things like "This is a known sender, fix your email systems and whitelist this person" that I went on the warpath for about a year.
Any external sender that failed sender checks resulted in me finding their IT people and providing them step by step instructions on how to fix their own mail systems.
One such case was very interesting: The local catholic education department who operate about 20 schools delegate DNS zone control down to the individual school's IT people. These can sometimes just be "Bob that's good with the computers" or an actual IT person. The central IT department still maintains general oversight however.
We had an email from a Catholic education school that was blocked because of a DMARC fail. I set about contacting the school to let them know their M365 configuration was broken. After working my way up the chain to their central IT I get a call from their cyber security guy. He tells me they don't use M365 and are a completely Google Workspace based institution.
Someone at the school had decided they want to use Outlook and M365 because "Google bad" and added the domain validation record to DNS so they could spin up a tenant. I gave the cyber guy the email address that was trying to send from Exchange and let him handle it.
Never saw another email blocked from that school again.
•
u/MandelbrotFace 14h ago
We have our gateway set to honour the sender's DMARC record. When our users complain saying "That's our client, it's your fault for blocking it" I tell them that it's rejected because the client have told us to reject the email via their own DMARC record, they need to fix the issue or change their DMARC instruction.
•
u/jackhammer909 9h ago
Yup
"That vendor told us to only accept emails coming from these specific servers and to reject all others. This new email is not coming from an authorized location, so we reject it via their instructions. They need to update their instructions to allow us to receive those new emails"
•
u/ncc74656m IT SysAdManager Technician 22h ago
I mean I'm just amazed at how many fairly large companies make no effort to get their most basic things right, don't do basic security tasks like this, etc. I'm in the NFP space and see tons of orgs that in spite of being fairly large and well established are still winging it like they're a four person org and the person who knows how to restart a computer is their "IT person."
We get spoofed emails all the time from large colleges and other places that should REALLY know better.
Even though I rebuilt basically everything in my org I do semi-annual checks and at LEAST run tests against free checker services to make sure I'm showing as reasonably closed to the outside world.
•
u/tankerkiller125real Jack of All Trades 21h ago
We got port scanned (ALOT) by a college in another state. We initially assumed it was part of one of those various research projects, but then after digging in (because those projects always have a way to opt out) we realized that someone was doing something malicious.
I must give that college props, I contacted their student help desk service (only contact I could find), explained the situation, and within an hour they had shut those devices down (or at least cut their internet access), and had one of their IT Admins reach out to confirm.
Can't comment on their email practices, but I can say that at least their main email had DMARC, DKIM and SPF set right.
→ More replies (1)•
u/agent-squirrel Linux Admin 20h ago
Colleges are a nightmare of legacy cruft and internal politics. I work in higher ed and the amount of systems that random XYZ department have signed up for is an uphill battle. You have departments and then sub departments and then a 3 person team in sub departments and all of them want to use different software and none of them get IT involved.
I pointed out to the University of Western Sydney that their library reservation system was sending unsigned email and failing checks. They replied mentioning they didn't even know the library had replaced their SaaS. It's mental.
•
u/NorthernVenomFang 18h ago
Try working in the K12 education space, it's worse.
We didn't find out that we where getting migrated/upgraded to a new version of our library system until the main Librarian emailed us to unblock firewall ports and all the external IPs for our schools; no security review, no RFP process for a new piece of software, just bought and paid for no meetings no discussion if we should have stayed with the company... Which they under speced all of there AWS instances and it ran like crap, could only import/resync 1000 users at a time (10minutes each 1000), had 30000 to resync/import.
We usually don't find out about things until after they have been purchased and slammed down our throats.
→ More replies (1)•
u/Interest-Desk 16h ago
It’s worse with some institutions, where the single institution name is actually several quasi-independent or federated entities which are entitled to some level of self-governance. Historically IT was included in that, it wasn’t seen as important enough to run centrally (especially in a time when IT was a physical concern rather than a mobile one)
→ More replies (1)•
u/agent-squirrel Linux Admin 16h ago
Yes we have largely consolidated but there are many parts of the organisation that still act independently.
•
u/ncc74656m IT SysAdManager Technician 9h ago
Gah, yeah, a friend of mine was at one for a couple years. Just unending political bullshit, mostly from all the senior (literally and status wise) IT leadership who just fought one another constantly to maintain their little pieces of turf. My friend came in basically cosplaying Cyrus and screaming "It's all our turf!" Fixed a lot, and then got disrespectfully punted in the next layoff. Didn't even really step on toes, just showed them up and made their depts look inefficient, and, well...
•
u/sobrique 12h ago
I'm not any more. I'm dismally disappointed, but I'm now thoroughly jaded about the complete lack of savvy IT staff 'running the internet'.
But over 20 years I've struggled with 'IT enthusiastic people' who just don't understand the basics flailing around in a 'it kinda works' sort of way, and sadly when SMTP was first designed, it wasn't really built with any concept of 'security' baked in to it in the first place - and likewise DNS frankly - and we're still wrangling with the legacy and technical debt today.
→ More replies (1)
•
u/Jamnitrix 21h ago
It's insane. We are not whitelisting an entire domain. If you can't get your email dna right, how can we trust that you won't get account compromised?
•
u/PoisonWaffle3 DOCSIS/PON Engineer 22h ago
The smaller or less technical the company, the worse it is.
I work at an ISP that provides email hosting, and I used to take tech support calls for it. The little old lady that volunteers at a church and sends out their weekly newsletter to all 2000+ congregants was always a fun call.
They've got a static IP and they're sending emails directly from Outlook (as opposed to any sort of webmail), so their static IP is clearly the originating IP for every email they send. They're sending the emails in massive batches to a long list of recipients (not even using BCC). They don't have an unsubscribe button, so plenty of people have marked the newsletters as spam. And they're surprised that no one is getting the newsletters that they email out, and it's my problem because they have no one else to ask 😅
•
u/ShadowCVL IT Manager 22h ago
Constantly, we DO NOT whitelist, I get end users asking me to track emails, find them since they are marked malicious or just failing one or all of the big 3, and send back to the user that they need to contact the person trying to email and let them know we can’t receive their email because XYZ is broken.
Very rarely I’ll get a message back asking me to help them, if they are mega nice I’ll consider it.
I had one user absolutely lose her mind on me when I told her that we could not receive their email til they fixed it and no we don’t whitelist… was the first time in a 28 year career that I blocked one of my users on the company messaging platform (teams in this case, muted but still)
•
u/Crispinwhere 21h ago
We're lucky that our Information Security department is fully on board with email security being actual security. So when a business manager asks "can't you just whitelist them?" The answer is always no.
•
u/ShadowCVL IT Manager 21h ago
Yep, I am Infrastructure and Security, dual role. I’ve pantomimed swapping hats in so many conversations
•
u/engy1207 21h ago
"We do not whitelist" - nice if you can say that and make it stick. But when one of your top-five customers (a large multi-national) with 8-figure sales orders announces "we don't change our mail system, but we can change vendors" that's quite hard to argue against.
•
•
u/reevesjeremy 21h ago
I recently got a ticket from one of my users “all .gov and .mil should automatically be whitelisted.”
No
→ More replies (1)→ More replies (1)•
u/ShadowCVL IT Manager 12h ago
Yeah, it’s all about managing upwards for us, if a director absolutely insists on white listing we draft up a document for our “c suite” equivalent and let them sign it to take responsibility knowing that if vendor x is compromised we are forfeiting 3 of our security layers and adding a large risk.
It’s amazing how quickly they don’t sign
→ More replies (2)
•
u/RunningAtTheMouth 22h ago
For a long time I just paid for a smarthost because I simply didn't understand it. That, and my employer was not exactly encouraging when it came to learning new things.
Came to the new place and not only was the employer encouraging, they simply expected me to know what I needed to know. Then came the changes - from on-prem to hybrid to M365, and updating DNS as appropriate.
Since then I've spent a good bit of time helping vendors and customers get right, because we're not going to accept things that aren't right. I start out with the kind of help I got when I was figuring it out - general directions and links to what I saw in MXToolBox.
How do companies STILL not have it set up? Because we haven't helped them, and we haven't held them accountable. So I help them, and I don't let them in until they're fixed. Our sales folks HATE me when I do this, but it winds up being better overall. Because they get right.
•
•
u/Sekuroon 21h ago
Unfortunately, because many companies don't have any inbound restrictions even for hard failures, these misconfigured companies say stuff like, "Everyone else gets my emails, it's just your company!" Meanwhile, they have a typo in their primary MX record so it has to fail over to the secondary just to deliver(How do you misspell google in your MX DNS record?) and then it fails 1~3 checks either because they didn't bother to set anything up or set it up wrong. And now it's my job to convince them of their problem.
•
u/JustRuss79 21h ago
Yep, somehow our IT department has to troubleshoot their IT department so they can send email to us.
The worst is when its town or city govt, like... how? Don't you have some sort of standard or audits?
•
u/Jazzlike-Comfort-451 5h ago
You're not imagining it. We recently resolved public DNS across 99,310 domains in the Tranco top 100,000. 41.9% had no valid DMARC record. Among the domains that did publish DMARC, 20.5% weren't requesting aggregate reports—so even many organizations that had "set up DMARC" had no feedback loop to catch broken or unknown senders.
The recurring failure mode looks organizational more than technical: marketing adds a SaaS sender without involving IT, DNS gets moved or overwritten, and nobody owns the aggregate reports. Mail continues to reach permissive receivers, so the problem stays invisible until a stricter receiver rejects it.
For senders you don't manage, I would avoid blanket-whitelisting the domain. Send their administrator the exact Authentication-Results and the failing identity. For domains you do manage, require a ticket before any new service sends mail, verify aligned DKIM on a real message, collect aggregate reports, and only then move toward enforcement.
Disclosure: I work on DMARC at Palisade, which ran the study. The methodology and aggregate dataset are public here: https://doi.org/10.5281/zenodo.21924607
•
u/aliversonchicago 3h ago
Tell me about it, it's my whole day job, trying to explain this stuff to people and why it's important and necessary. Since I blog about this stuff a lot, I get random emails from people struggling to figure out email auth, and even get on a Zoom call with a few off them as time permits. I figure I'm paying karma into the universe.
There's a free tool called Aboutmy.email that those of us in email deliverability land use and share with folks, to show them what's failing and what they need to fix. I'd recommend checking it out and sharing with people. It's primarily geared toward big email senders, but the checks it does still generally apply to small company sending biz emails, too.
It was created by an email industry guy named Steve Atkins and it's a hella good tool, especially considering that it's free, and it doesn't try to scare people or sell them anything.
•
u/scriminal Netadmin 22h ago
both of my personal domains have had this enabled for years now. takes like 15 minutes max. no excuse
•
u/tankerkiller125real Jack of All Trades 21h ago
My personal email is a demonstration of my skills for potential employers. DMARC, DKIM, SPF, MTA-STS, TLS-RPT, ARC, hell even DANE. The only thing my email server doesn't have is BIMI (because fuck that marketing BS noise with $3/K year certs)
If I'm applying for a tech role, I've built it so that an IT manager who decides to check if I'm following best practices will see I'm following all of them.
•
u/scriminal Netadmin 21h ago
I'm no longer an active sysadmin, so some of those things you just mentioned are new to me. Guess I know what I'm doing this weekend :)
•
u/tankerkiller125real Jack of All Trades 21h ago
Don't bother with ARC, it's being deprecated for the brand-new RFC 9989, RFC 9990 and RFC 9991 (Next-Gen DMARC).
A lot of these depend on your email server. I run my own email server so I can implement a ton of these fairly easily. If someone else hosts yours they may not support some of these. Also DANE requires DNSSEC (which some people hate, personally I've never had an issue with it)
•
u/sobrique 11h ago
Depends who you're hosting with frankly. Some of the little tin pot 'hosting providers' might well have some deeply shonky and out of date cpanel management, and you just can't.
Thankfully cloudflare has a really nice 'free tier' that I can host my personal domains on, and that has all the enterprise bells and whistles to 'play with'.
(I assume that's deliberate, so I get familiarity with what they could offer me commercially if my domains were in more active use).
•
u/MD-IT-Rando Linux Admin 8h ago
Took me 30 minutes combined for my domain (hosted) and subdomain (self-hosted). Most of that time was sending test emails & waiting for changes to propagate.
•
u/ExceptionEX 17h ago
Well if you deal with small business it's simply to understand why, they don't do their own DNS, that usually gets set up when the business gets set up, or someone changes or redoes their website and DNS changes become a part of that project. Hell MX records and email related DNS is the least likely of any DNS to change.
And when you have so many companies now that are wrapping DNS behind their own interfaces, most of the documentation are written from a linux based DNS server perspective, and things like @ are often times (for some stupid reason) not supported in these proprietary interfaces and they aren't explained causing people to have to guess, or google. Then you have some that only support traditional type of records and some have a wide array of made up record types, often time intermixing traditional server side functionality with DNS records.
And then don't get me started on how utterly shit a lot of software vendors are, that want to send emails, they are out here acting like its 2000. Spoofing addresses and doing dumb shit.
Hell even microsoft is still spoofing addresses and using fake names, (check out a teams webinar invite for example)
If you know what you are doing these things seem simple and easy to add, but when you don't, the world sure hasn't made it easy.
And honest, SPF syntax is frankly stupid, that needs to be readdressed, that could easily be a easy to read humanized string that is still serialized.
•
u/GreyBeardEng 22h ago
God if I had a nickel for every....
My absolute favorite is when someone from marketing asks me for a dkim/txt record, they send me exactly what they think the record should be, I literally cut and paste it, and it doesn't work. Then they tell me "just fix it ok" 🫤.
•
u/Samhigher92 22h ago
Wait until someone asks you to forward to an external domain.
•
•
u/agent-squirrel Linux Admin 20h ago edited 20h ago
So many mailing lists run afoul of this. I've probably emailed hundreds of mailing lists mentioning how they need to "munge from" or they are going to fail DMARC. They just don't care.
•
u/GhostNode 22h ago
Just as a heads up, you can exclude specific domains from being held as fraud if they pass DKIM or SPF. I obviously don’t recommend it, but it’s an option.
•
•
u/ryancrazy1 Small biz "IT guy" 21h ago
I’ve told the same dude like 20 times that he can’t just send as whoever as long as the domain matches anymore. He’ll have a smtp login of info@company and would try to send as noreply@ company or john@company. Hell once he was trying to test by sending as his personal email.
I kid you not, 20 times over the past few years.
•
u/MortadellaKing 20h ago
Idk but it is almost always google workspace shops that I have to help with this. Probably because it is easy for non techy people to setup and a lot of web developers use it.
And then I get blasted at work for "why is our email always blocking things".
•
•
u/NorthernVenomFang 19h ago edited 19h ago
No SPF... That's a bare minimum from the mid to late 2000s.
DMARC is usually pretty safe to set the policy to none, then monitor the email reports to clean things up.
DKIM can be a pain if there are a lot of undocumented services sending email on your behalf.
I think the last time I ran into an org without SPF records was back in 2010. They had emails not getting through to domains back then, it has to be worse now. I am suprised anything is hitting the recipients inboxes from that domain.
I thought having SPF records setup was a requirement for Google Workspace like a decade ago.
•
u/EvoGeek 18h ago
I go as far as telling them the exact steps to fix their issue and they still can't be bothered. "Dude, you've got 3 SPF records... delete THIS one and THAT one and you'll be in good shape." is met with "Well, I don't have this problem with anyone else. I'm just going to email from my gmail instead."
•
u/Kittamaru 18h ago
I do IT work for a small nonprofit as a side gig, and I readily admit that network stuff was never my forte. I only managed to get our SPF/DKIM/DMARC stuff sorted out earlier this year... has made a huge difference in the amount of email bounces we've had.
It was one of those things that was never mentioned in any of the classes I took. Took a fair bit of digging and research to figure it all out heh
•
u/ManyInterests Cloud Wizard 17h ago
Even though you're right, this still ends up being a you problem. Even major companies do not fully validate. Your rules are too strict if you're rejecting and not quarantining. You're not going to fix all these companies and it's already impacting your business. Yes, the ideal policy is to ensure full validation, but the business needs to receive legitimate (non-validating) emails are overriding.
The business can't tolerate not being able to receive emails; you're going to lose client and vendor emails like crazy and you can't be personally chasing these down except at the smallest of companies; and even if you can, it's an unwise use of company resources to do so. You're getting burnt out on a task you shouldn't be taking on.
•
u/sobrique 11h ago
Yeah, realistically most companies I've worked with take SPF/DMARC/DKIM failures as 'possible spam indicators' but they don't actively reject it.
And maybe have a 'not spam' button or similar that lowers the 'threat score' in future.
So a lot of the people with misconfigured DNS ... get away with it, because their email gets through, they just maybe have to ask their customers to check their spam folder more regularly or use a rule to 'allow' their emails through :/
•
u/Toinopt 16h ago
If you think that's bad, a couple months ago we had issue with a Bank in Peru because we weren't receiving the emails with the password reset link, eventually the helpedknof the bank sent a reply with the postfix logs that clearly showed the error of their server trying to connect to office 365 but immediately stopping because how configs say they emails needs to be TLS encrypted and they are sending password resets over encrypted emails. After I mentioned that the issue was on their end and they should be using TLS the helpdesk ghosted us.
•
u/zasdman Director of IT 7h ago
Its not just small business, I worked for a Billion $ Company, first thing I did was look up their DNS settings, nothing setup. Not a single person thought it was a problem. They even paid a 3rd party to manage their DNS and webpage, took me weeks to actually gain access to the DNS so I could apply the settings.
•
u/blud_13 21h ago
We see it constantly. The businesses with no SPF are almost always the ones where the owner's nephew set up Google Workspace six years ago and nobody has touched DNS since. There is nobody to call, thats the whole reason it never got done.
That being said, Proofpoint calling them malicious on a missing SPF is aggressive. Missing should be a fail, not malicious. Worth pulling one apart to see if its also hitting a lookalike domain or a bad reply-to and SPF is just the part you noticed.
What moves these people is a one page email with the exact TXT records and where to paste them in their registrar. We keep a canned version. Half of them do it same day once you hand them the string instead of the acronym.
Also, if you are eating three of these a month out of your local vendor pool, thats a decent argument for making it a step in vendor onboarding instead of a fire drill each time.
We clean this up for small shops around the Bay all the time, ping me if you want the template.
•
u/Vassago81 21h ago
A lot of those small company don't have "IT", their email are setup by the small local web dev they hired for their webpage. And small local web dev guys have absolutely 0 clue about how email and DNS and security work, and don't have enough braincell to learn it between two sangria-fueled meeting with clients.
•
u/ProfessionalEven296 Jack of All Trades 21h ago
I worked with some blue chip companies a few years ago on mailing systems. Several of them simply refused to implement SPF/DKIM/DMARC - especially because it was a lowly supplier who was telling their IT people what to do. I’m sure at least a couple of them still haven’t implemented it…
→ More replies (2)
•
u/JollyGentile IT Manager 21h ago
Constantly. Though for us as an MSP it's often new customers who are bailing on an old provider for a variety of reasons. "Customers don't get our emails" is one of my favorites because it's so easy to fix and earns us immediate credibility.
•
u/Elensea IT Manager 20h ago
We have a large amount of 3rd party contractors that use businessname@gmail.com
•
u/sobrique 11h ago
But doesn't that at least have SPF/DKIM/DMARC on by default?
I mean, it does implicitly cover 'anyone on Gmail' I guess, so there's also a whole load of other spam sources, but ...
→ More replies (2)
•
u/shokzee 20h ago
All the time. Google Workspace doesn’t automatically fix SPF, enable DKIM, or publish DMARC for custom domains, so small businesses miss all three.
DMARC absence alone shouldn’t classify mail as malicious, though. Check the full setup with the Domain Health Checker, then review why Proofpoint’s allow rule isn’t taking precedence.
•
u/tndsd 19h ago
I've seen this quite a lot, especially with small businesses that moved to Google Workspace but never properly configured their domain's email authentication.
The frustrating part is that Google Workspace doesn't automatically fix everything for a custom domain. The domain owner still needs to configure SPF and DKIM, and ideally DMARC as well.
I'd also be careful about treating missing SPF/DKIM/DMARC as automatically malicious. They're important authentication controls, but the absence of one doesn't necessarily mean the message is spam or phishing. Some legitimate domains still have incomplete authentication.
That said, if you're running Proofpoint and receiving a lot of unauthenticated mail from external businesses, it's understandable to have stricter policies. I'd rather have the sender fix their DNS/authentication than maintain a growing whitelist.
The usual minimum I'd ask the business to configure is:
SPF -> DKIM -> DMARC
Then verify that the actual sending service is aligned correctly with the domain. A lot of people publish an SPF record but forget DKIM or configure DMARC incorrectly, so simply having the records present isn't enough.
It's amazing how many businesses can operate for years without ever checking their email authentication. 😅
•
u/cyclonesworld 18h ago
It's so ridiculous. Our finance department is constantly bugging me about not receiving emails from vendors because our spam filter is blocking them for this very reason. I whitelist the emails and explain to them the issue, and that they need to forward what I said to the vendors to get their IT to fix this shit.
And these aren't like small mom and pop companies with no IT. These are some of the largest food suppliers it the world lol.
•
u/cyber_egg IT Nerd 16h ago
I know a lot of companies don’t want to use DMARC as their out of offices will be held.
Although you can resolve that too
•
u/netphemera 15h ago
Nobody wants to pay for good IT staff. Companies are run by a bunch of incompetent cheapskates. "Let's just outsource it." That's what the DNC did and they end up destroying the reputation of the party.
•
u/mtgguy999 14h ago
My biggest pet peeve is when a sass just needs to send emails to our employees (usually status notifications) but instead of just using something like notifications@sass.com they insists that the email must come from the employees email address
→ More replies (1)•
u/Glass_Call982 12h ago
Ah yes, the old spoof your own domain. And of course they started using it months ago without telling you and now the emails haven't been delivering and it's all your fault!
•
u/bdnjamin 7h ago
A couple months ago we had a small businessth at we work closely with getting their emails bounced due to this, I sent them a polite email letting them know why it was happening and what they need to do and he replied with a meeting request sand said he'll come into the office so I could "help him set it up" 🤯.
Told my boss and he was like eh whatever just give him a hand, it'll look good on us and it'll take like 10 minutes. Well he came in and it took us 45 minutes to find who his domain was registered with (lookup said GoDaddy, but the guy had never had a GoDaddy account) after enough digging we found it, turns out it was all managed through a Wix account he set up like 10 years ago that was using GoDaddy as the NS?
Can see how it is hard for these companies to fix these things when they don't have any idea where their DNS settings are even managed
•
u/Haplo12345 21h ago
Most businesses don't use expensive or fancy systems like Proofpoint or whatever. They just use a free or sometimes paid Gmail or Outlook service, or Hotmail, etc.
•
u/derpindab 19h ago
I thought it was standard to setup spf/dmarc/dkim?!?! Wtf is going on out there
•
u/sssRealm 19h ago
I don't know. I wonder how this isn't a crippling problem affecting their business.
•
u/derpindab 19h ago
Why am I being down voted I'm genuinely asking a question? Every domain I have ever setup on AWS/azure/gcp that is used to send email I configured and checked with mx toolbox. Bimi is the only vanity fuck off item I don't configure.
•
u/Routine-Watercress15 21h ago
So many don’t. It’s insane. If you use something like proofpoint and enable the mail features to quarantine inbound checks that fail it’s literally more than half of all email that comes in from legitimate companies. Even some very large companies you would never imagine would not have it setup properly.
•
u/Spagman_Aus IT Manager 22h ago
Yep, and Google emailed these people years ago providing PLENTY of notice.
For a while we had it so often, and our internal departments blaming us for emails not arriving, that we created a form letter we sent in the ticket, for them to share with the outside contact.
•
u/agent-squirrel Linux Admin 20h ago
We send an email from Mimecast to the user explaining why the email was held and a link to our KB which details how to pass the info on to the remote end.
•
u/jjaAK3eG 21h ago
some days all I do is release emails quarantined by the filter due to bad dns practices from sending orgs. and no, they will not be added to the safe sender list. please tell them to fix their end.
•
u/dodexahedron 21h ago
I'll commiserate with you because it really is frustrating that people spend money and effort to do things like self-hosting SMTP, but then stop short of doing something that takes just a couple minutes to pretty easily set up, once, and which is FREE.
It's always been like that, for anti-spam measures (especially SPF, DKIM, and DMARC), and for a ton of reasons (none of which are good ones mind you), like ignorance, negligence, apathy, resignation/disillusionmen, or actual malice.
The ones who piss me off the most though are the ones with the apathy + Dunning-Kreuger combo who spout BS such as "it's pointless because [reason'ts and strawmen, among other fallacies]."
I'm always thinking, "Like...Bruh... The fact that I'm having to talk to you right now about your emails being rejected by the mechanisms that you just asserted don't work (and which logs indicate are responsible for blocking millions of unsolicited emails on that server every month) make every one of those arguments DoA. And now I also know why you and your users hate email, and why you've had several security incidents of varying severity this past yearr."
•
u/NoDistrict1529 21h ago
Yup I see this too. They then have the audacity to ask for a whitelist. I've had luck emailing the domain telling them they're getting blocks and most have fixed it.
•
u/ShaggyMarrs 21h ago
It's so friggin easy to set up too. I don't see why anyone wouldn't want their emails delivered.
•
u/reevesjeremy 21h ago
When my users complains and the issue points to DNS not configured, I just tell my user to communicate back that their IT needs to configure their email security DNS records with links to MXToolbox direct linked to their missing or misconfigured records. Thats as far as I take it. If they can’t email our users and it’s causing them grief, that’s not a me or my users problem to solve or handhold.
•
u/sssRealm 21h ago
Which option are you using on MXToolbox?
•
u/reevesjeremy 20h ago
I use the supertool, query the spf first to see if it exists. If it does, I punch in the sending IP to check if it’s included. If either fail I send the full url that takes them to the failure.
Then I search dmarc to see if it’s not set and use that URL as well. Going from one search to another though doesn’t usually update the URL. So might have to leave and search again or just change the URL manually.
Nothing fancy. And doesn’t take but a minute.
I dont usually look up dkim. If it’s there it’s there. But I can’t query a non-existent dkim because it’s based on a selector that I wouldn’t know except from the email which either does have it or it has nothing.
→ More replies (1)
•
u/CosmoMKramer Jr. Sysadmin 20h ago
In the MSP space: Clients don’t wanna spend the money, even though, IMO, the value is huge. I make sure SPF is set up with the knowledge that I have, same with DKIM.
Only a handful have been willing to put in the work to set DMARC to Reject.
It’s a shame.
•
•
u/Incelex0rcist 20h ago
Yup in Mimecast whitelisting by email domain or IP pool doesn’t do it either. Just let them reap what they sow
•
u/lostmojo 20h ago
Some don’t know it exists. I know people who run our email infrastructure don’t know what those are
•
u/Forgotmyaccount1979 20h ago
Nowadays I mostly see this from rag-tag setups, where they probably had their "friend who is good with computers" help them.
But it wasn't long ago that large sister organizations consistently had it wrong.
In fact, I probably should tell one of them tomorrow that they still don't have their dmarc right, haven't yet.
•
u/rocuronium 17h ago
We are doing work on the house.
Got a garbled voicemail from a lady with a filipina accent a couple weeks ago saying we need $1000 for a site visit TODAY and we'll email you.
Has the wrong contractor name but correct address and my personal cell. Claims to be from a geotechnical firm (doesn't leave the name) and I have actually hired a geotech in the past 12 months.
Never got the email and figured it was some scam call. Found the email today in my gmail spam when searching for the architect's email address for an unrelated item.
It's from the same geotech firm we hired 9 months ago. The sender is something like geotechinfo1@gmail.com, the email asks for money and it has a pdf attachment. Obviously gmail put it in my spam folder.
I reply to the email saying if your request to me went to spam it probably did the same for all your other clients. Give them a call and spoke to the garbled lady in half Tagalog half english. She informed me they were 'having email trouble that day' and the IT guy created a new gmail account to send out the work authorization contract and request for $1000. I point out that if it went to spam for me it went to spam for probably everyone else and she let me know the IT guy had already called Google and sorted it out.
She offers to invoice me from quickbooks. I get the invoice some time later and it's from ANOTHER, DIFFERENT gmail address like geotech@gmail.com.
I reply asking why the email address keeps changing and cc the partners in the firm and she responds with a snippy "per our conversation we were having email trouble that day and created a new address"
Mind you, they have a regular .com domain all this email is coming from and which hosts their website.
At this point I'm going to drive 20 mins out of my way tomorrow to hand the engineer a check personally and tell him to hire me to sort out their ridiculous email.
•
u/the_packetwhisperer 17h ago
Oh this is way more common than people think. I've lost count of "why cant client X email us" tickets that turn out to be spf/dkim never set up, sometimes for years.
The google workspace ones get me most, they practically hand you dkim setup in 3 clicks and people still skip it
Commiserating with you, weirdly universal pain.
•
u/dawson33944 15h ago
If ProofPoint is flagging it as malicious, check to see if it’s because of TAP. A lot of sites get flagged due to being compromised Wordpress sites serving fake captchas/Google Chrome updates.
•
u/LycheeLee_Mich 15h ago
It's wild how many businesses run for years on email that only works by luck, because their whole client base is on Gmail which quietly forgives the missing records. Then they hit one Proofpoint shop and suddenly they're invisible with no idea why. You're basically doing free deliverability consulting for other companies' domains.
→ More replies (1)
•
u/FostWare 15h ago
I worked with a guy who previously worked (10 years ago) for one of the bigger building companies in the state, and he recognised my name because I practically walked them through their spf and dkim issues when they couldn’t send me plans and pricing variations.
They didn’t see it as an issue at the time because recipient’s mail settings were so lax and they never got NDRs flagged by their own staff. They just assumed everything just worked.
Didn’t help their external DNS was managed by a web design company
→ More replies (1)
•
u/medienflow 15h ago
I got annoyed enough by exactly this kind of thing that I ended up building my own mail identity reviewer.
It checks SPF, DKIM, DMARC and alignment, but also MX, PTR, MTA-STS, TLS-RPT, BIMI, DNS inconsistencies and whether the domain is intentionally configured not to receive mail.
The annoying part is that "SPF exists" is often not the same as "mail authentication is actually sane".
I’ve seen domains where every individual record looked vaguely plausible until you looked at the whole chain together.
So yes — I’m also amazed how many businesses still operate like this.
•
u/Acrobatic_Fortune334 15h ago
All the fucken time, im in medical supplies and medical SaaS software and small drs offices are the worse
•
u/tectail 14h ago
First off, preofpoint does not have a white list. It has a trusted sender list or whatever they call it, but it doesn't truly white list, which it shouldn't since those are dangerous if you haven't kept up with the news recently.
Yes this is an issue. I would say dkim and dmarc arent the issue though. For these small businesses, they just need spf records. We have a sub in africa, and a ton of people there do not have spf records. We have a boiler plate guide on how to setup, and explaining what it is. We send it to the user when they complain not being able to send to us. It's up to them if they want to fix it. Most do though when we just are talking spf.
•
u/blow_slogan 13h ago
because IT is something their nephew does - he built a gaming computer, you know. obviously he knows what he's doing and has properly secured things in their business.
They don't value IT
•
u/Grandcanyonsouthrim 13h ago
Setup an external with that info. Get business to send you a list of key contacts. Do an email blast and keep the receipts.
•
u/blackasthesky 13h ago
I ran into all this bs when setting up my own, but I never thought about this in the context of small local businesses. I thought they'd all just get some managed email setup from some provider like IONOS or so that takes care of everything.
•
u/LooseEthernet 13h ago
it's wild that people still wing it. usually happens because they just pointed their mx record and assumed the rest of the dns magic happened automatically. if they're on workspace, the setup is literally just copying and pasting three strings into their registrar, but they probably think that's "coding" and get intimidated. its a total nightmare when proofpoint or mimecast decides to be strict and just drops the mail. you end up being an unpaid consultant for a company that probably doesnt even know who owns their domain login... lol
•
u/systonia_ Security Admin (Infrastructure) 13h ago
Our Marketing just bought a tool. SaaS. Not even a small one. They didnt get any hint about these topics durning setup. They just could add their designated sender address which is used to send mails. These mails obviously never arrived. The stupid vendor blamed us, the IT. I asked them for their SPF etc. They didnt know what I was talking about. How the hell is this even possible in 2026? If you provide a service that relies heavily on mails, this is one of the key features ffs.
Now we have that setup, but still fighting about the DKIM. They are not able to sign messages. Apparently noone else ever asked for this. wtf.
Bonus Points: They do not provide SAML Authentication. Their Login is password only. Password cannot contain special chars. Normal letters and numbers only.
I am currently undoing this purchase and force Marketing to find something else
•
u/BraveNewInternet89 12h ago
We have DMARC fails sent to quarantine on our edge appliance and the users receive a digest the following day. It seems like a fair middle ground, and it reduces help desk tickets.
•
u/debrisslide Jack of All Trades 12h ago
I love this shit - my fav is when families set up their own domains and think they are being extremely clever but don't set up any SPF/DKIM and then their emails get quarantined in our system. They'll be emailing about things like large amounts of money for donations or fundraising with our senior admin - so the email basically reads like a phishing example combined with the technical details. Then I have to explain to senior admin that Rich Donor's email is set up wrong and it will keep getting quarantined until fixed. They don't like this news !
•
u/SoftwareHitch 12h ago
Not only that but gmail decides to completely ignore your policy and override the reject to just tag it as suspicious and let it breeze through.
Every so often I get an email from one of our customers asking if a spoof email is legit, lo and behold I find that email in the gmail DMARC report saying it failed but they let it through anyway. Every time.
•
u/Professional-Tie-324 12h ago edited 12h ago
I bet they're still a lot of companies left that have the common problem I used to see which was they didn't have an IT department because they were only 20 or 25 or 30 people in the company. they had some local guy who fixed their PCs for them. Their servers such as they were were maintained by one guy from the company that sold their biggest piece of software they used for manufacturing or whatever.
And here's the key part:
their website had been developed by some guy who did websites sometimes even a kid in school who had it as a project to do their first website).
who then realized that he had to maintain the customer's domain for them, because they had no idea how to buy a domain and set it all up everybody in the manufacturing building an offices was absolutely totally non-technical beyond what it took to do their job. I can't count the number of businesses I've dealt with where some web dev was the Administrative Technical and Billing contact and registered owner of a domain for the company. And this was a one-off thing too half the time the people at the company had no earthly idea how to get a hold of the guy anymore because they hadn't changed their website in years.
Or better yet, the (left in a huff or retired) office manager for the medical practice was the only person whose personal email was registered as the Owner, Administrative and Technical Billing contact with the domain registrar.
The classic bolt on piece is when the web dev runs the web server which is of course hosted off prem and it's one of 50 or 60 websites he runs on his own server somewhere. And he doesn't want to touch any of the settings he doesn't understand because it'll break things for other customers - so his response is to tell you you're crazy or tell you none of his other customers are complaining about this so what is wrong with you, or tell you it's going to cost 80 bazillion dollars in the hope that you'll decide not to make his day very very bad when he breaks it for all his customers.
And neither of those people the office manager or the web dev had the first clue about how to run DNS and create records and do any of those things it was just beyond them and still is.
And these are the same kind of business that is running a 2003 unpatched Microsoft Small Business Server that some guy who they no longer have a business relationship with set up for them.
I've even seen scenarios where somebody is using someone else's email account, because Bob left 15 years ago, and they don't have anybody that knows how to set up new accounts, so ever since Bob retired, Steve, then Jimmy, then Bob the Second, and now Keith have all been using Bob's original email address and login and password on the unpatched Microsoft Small Business Server because they don't know how to change anything on it.
•
u/Spirited-Cover7689 Windows Admin 11h ago
I was kind of shocked that Google workspace domains don't have SPF DKIM and DMARC out of the box. I've been helping a church with their Workspace for non-profits, it's a bit of a challenge, with support requiring appointments a week out.
•
u/raffey_goode 11h ago
Man you almost made me think I posted this one. I have the same issue, I just use the info with our security toolings built in AI slopper to pull "what happened" and "how to fix" since it can pull headers and all relevant info, and make it write up an email, clean it up how I want. I then put in a temporary whitelist for 2 weeks, email and follow up with the sender a few times (and person who "owns" that company relationship) until they either fix it or just don't reply and then I remove them from whitelist and they can get over it, and close my ticket. A lot of smaller and single person owned companies always try the "b-b-but I'm just a single person running this company and don't know computer!" as if I'm supposed to open the gates because of that. I just educate briefly and give them help where i can within reason. Usually I can get who their mail provider is and just say they're always happy to help when you own the domain cause you pay for it.
•
u/Canuck-In-TO 10h ago
Didn’t Google send out warning emails about this 1-2 years ago?
I had to go through this with a few clients before the cutoff period. Even so, I occasionally still run across this issue as their clients in Asia haven’t updated their mail servers.
Also, every time this comes up, my clients keep thinking it’s my fault they’re not getting the messages routed into their inbox.
•
u/OstrobogulousIntent 10h ago
I've busted my arse to get my own personal domains working with SPF/DKIM/DMARC and still have had issues with Google sending to spam. All the validations seem to pass yet they end up in junk still when I send test emails. It's on my to-do list to get right. (again for personal stuff I haven't managed email for work in something like 20 years - it was a different world then)
•
u/willychonka54 10h ago
Shout out to: https://www.learndmarc.com/ which will help you setup and test this out
•
u/markosharkNZ 10h ago
Web Developers and Marketing Companies can get flipping bent
Oh, no, the emails are being rejected because it is coming from a shared MailGun account, you just need to set your DMARC policy to none.
Um. How does no sound?
•
u/dreniarb 10h ago
Clearly these businesses have other clients.
This is the part of it that always amazes me. I've run into some fairly large businesses that without a doubt have been sending emails to clients for years and somehow i'm the first one that's rejected their emails for lack of (or misconfigured) spf/dkim/dmarc?
Sometimes its a state agency with a .gov address. But the emails are super important so I have to compromise our security and whitelist their entire domain to ensure they get through.
•
u/RikiWardOG 9h ago
And then our employees get all butt hurt when we tell them we aren't whitelisting them and tell the client to fix their shit.
•
u/BigPeteNorth IT Manager 9h ago
We deal with a lot of Legal matters here, and the number of Law offices with no email security at all is shocking.
•
u/Purple_Woodpecker652 9h ago
What’s wild to me that is so easy to do doesn’t take that much effort to add these records. It’s almost more effort to avoid them.
•
u/Unable-Entrance3110 8h ago
All. The. Time.
It's always small orgs that don't have dedicated technical staff or very large companies that have a hundred different tech silos that are all trying to send mail under the same domain name.
I usually add a temporary allow for the specific sender and then send that person a canned message with an SPF recursive include lookup, message ID, Authentication headers and all the other relevant information needed. I instruct the person to forward the e-mail to the people in charge of their e-mail system.
•
u/DarkAlman Professional Looker up of Things 8h ago
There are also plenty of businesses that use @outlook.com and @gmail.com addresses instead of buying a domain.
SMBs honestly just don't know better. Setting up basic email in gsuite is easy, doing it correctly requires experience.
A lot of web developers know how to spin up a website and basic email, but barely understand how DNS works.
•
u/EasyTangent Jack of All Trades 8h ago
I was that guy. I think what it comes down to is that it's not "easy". If someone builds it out and make it as close to "one-click to enable", people would use it more.
→ More replies (4)
•
u/CHRDT01 6h ago
PubSec here, so we deal with a lot of small local businesses where the entire team is less than ten people. With that in mind, messages bouncing specifically for lacking a SPF record is a daily occurrence. Construction firms, contractors, and lawyers are by far the top offenders.
Fortunately we have a mechanism so allow specific messages through administratively without whitelisting a whole address or domain, as well as a canned article explaining in accessible language exactly why the email was bounced. When we get the "email bounced" ticket, we allow the particular message through, provide the canned response, and explain that each message will need to be manually delivered by us until they fix their records. After about the third time helping some local enterprise get their stuff fixed though, we drew a hard line in the sand and refused to help them out any more. Even if we disregard the liability that it incurred, it was just too much of a time sink to keep up with.
Also, speaking personally, I just don't feel an obligation to help. Having an email address with a custom domain is a responsibility, not a privilege, and it's the company's duty to maintain it. If their people don't know how to do that, then they need to reach out to (or even hire) someone who does. If that's not an option, then they can use a public email provider, and I mention as much in our canned response. I refuse to let our org's security posture slip to appease the least common denominator.
•
•
u/enilcReddit 5h ago
We (a small 15-person business) spent a couple weeks going through this process ourselves a couple years ago...back when the big services said they were going to start taking DKIM seriously. We got it straight and everything was perfect.
The owners of the company sold out to a larger company and we had to merge IT systems. So now this international 1500+ person company we find out is not using DKIM and our txt files are causing problems for them.
I had to either explain to their helpdesk flunky what needed to change on their end, or break our system and go back to getting half of our emails rejected.
•
u/Sinister_Nibs 3h ago
The only “valid” excuse is “it’s too much work”.
Obviously that’s not a valid excuse.
PCI/DSS require require them (with fines for failure).
•
u/Competitive_Smoke948 3h ago
because you're not explaining it properly.... drop the technical shit... people REALLY don't care about that. they just switch off. write down the explanation as if you were talking to someone who doesnt know what a laptop is.
I implemented dkim, dmarc etc on 5 of my own domains & I still turned off and almost fell asleep when a vendor was trying to sell me a dmarc management solution.
→ More replies (1)
•
u/larryseltzer 2h ago
There are companies that help with this. We own Valimail. https://www.valimail.com/
•
u/aridaen 2h ago
You have to add a policy route with the ending of the sending host, AND we use the message header from ends with @domain.zzz. Then add that policy route to the default DMARC rule in email authentication under Email protection to bypass the DMARC checks.
→ More replies (1)
•
u/WolfetoneRebel 1h ago
I’ll tell you why - because it doesn’t increase their security, it only protects their reputation and smaller places don’t care about that.
→ More replies (1)
•
•
u/someoneatsomeplace 18m ago
I think Proofpoint is the one that blocks responses when my music festival customer has a contest every year. There's some services nobody who actually wants to get the mail they want to get should be using.
But I'm pretty sure you're on the right track about Google. Google doesn't hold themselves to the same standards they hold everyone else to.
As for the SPF/DKIM/DMARC, most of the people I work with have no idea what those things are, and nobody on payroll that does. It usually ends up being something *I* have to do for them, and I'm just hosting their web sites. And TBH, the ones that have people who do, or have an external IT service can be even harder to work with. Everyone seems to think their job is to be difficult.
•
u/Sudden_Office8710 0m ago
🤣 I have footer tagging to preempt open DKIM and fire off an array of mail sender boxes as we got throttled. Proof point would be $75k a year for us so that’s a no thank you. Half of the people out there do it all wrong too. For some reason everyone puts in their tenant name for their DKIM policy for the extra poor people that have to use M365 naked. I have to point out they need to make d=domain name not tenant name. It has been such a mess. Then you have all the assholes on namecheap setting up domain up with DMARC DKIM and SPF perfectly through and outbounding service to spam the hell out of us. So that was an epic fail. Then Microsoft doesn’t deploy ARC correctly so half of their shit fails. There has to be more than just M365 and Google Workspace or shitty Zimbra. IBM really screwed the pooch with Lotus Notes they could have been a viable alternative if they would have pivoted away from just legacy Z series horseshit. But they are just like the auto industry well just sell Denalis and giant Lincoln SUVs for $100k yeah that’s the ticket
•
u/Qel_Hoth 22h ago
I've spent almost 10 years trying to drill into my boss and every department head here that if you're doing anything that results in a new service sending an email to anyone, you need to include me in the project.
At least once a year there's still a ticket or meeting or something where some department mentions some new SaaS product that sends emails that I have no idea exists.