News for hackers. Stuff that matters.

A comment on Sending DMARC reports is somewhat hazardous.

Re:Sending DMARC reports is somewhat hazardous by madflo on Wednesday December 03, 2025 @05:58AM (#46133012)
I do operate DMARC report processing service and I have to agree that outdated reporting addresses living in DNS records (in my case, previous customers of mine still using their reporting addresses) are an issue.

Although the RFC 7.1 section regarding External Domain Validation [1] addresses this topic, I've found that lots of final hosts disregard this step and blast their reports to whatever reporting address is provided.

1: https://www.dmarctrust.com/email-dns/fundamentals/dmarc-dns-...

[ Parent | on HN ]
Re:Sending DMARC reports is somewhat hazardous by braiamp on Wednesday December 03, 2025 @07:01AM (#46133516)
Do DMARC report tools like opendmarc-reports [0] comply with that section? Which tool have you seen that complies?

[0]: https://github.com/nabbar/opendmarc-reports

[ Parent | on HN ]
Re:Sending DMARC reports is somewhat hazardous by madflo on Wednesday December 03, 2025 @11:41AM (#46136620)
To the best of my knowledge opendmarc-reports does not perform a DNS check for external auth, but I might be mistaken.

Major hosts (Google, Zoho, Yahoo, Microsoft) are checking for sure. Japanese hosts are the worst offenders. I will try to do a proper data extraction and report back.

[ Parent | on HN ]