Subject: [dmarc-ietf] Stats on DMARC adoption ?

From: "John Levine" <[email-masked]>
Date: 12 Apr 2022 23:27:58 -0400

Are there any public numbers on the amount of mail that is subject to
DMARC policy, number of mailboxes implementing DMARC policies, number
sending reports, stuff like that?

Someone was also asking about PSD adoption but I assume at this point
it is still zero other than some small tests.

R's,
John

---

From: Seth Blank <[email-masked]>
Date: Tue, 12 Apr 2022 20:39:35 -0700

Policies: https://dmarc.org/2022/03/dmarc-policies-up-84-for-2021/

For mailboxes that implement DMARC and send reports, Valimail (and Dmarcian
I believe) have historically tracked and published that. I'll hunt down
that data tomorrow. Off the top of my head, it was about 80% of mailboxes
globally (4bn+) properly validate DMARC, and the majority of those send
reports, with the notable exception of Microsoft, which is now finally
starting to do that.

For PSD, I don't think that's implemented anywhere at any major mailbox
provider, just in some open source libraries as a test.

Seth

On Tue, Apr 12, 2022 at 8:28 PM John Levine <[email-masked]> wrote:

> _______________________________________________
> dmarc mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dmarc
>

-- 

*Seth Blank * | Chief Product Officer
*e:* [email-masked]
*p:* 415.273.8818

This email and all data transmitted with it contains confidential and/or
proprietary information intended solely for the use of individual(s)
authorized to receive it. If you are not an intended and authorized
recipient you are hereby notified of any use, disclosure, copying or
distribution of the information included in this transmission is prohibited
and may be unlawful. Please immediately notify the sender by replying to
this email and then delete it from your system.

---

From: Jim Fenton <[email-masked]>
Date: Wed, 13 Apr 2022 14:25:15 -0700

> reports, with the notable exception of Microsoft, which is now finally

Out of curiosity, what does “properly validate DMARC” mean and how do you measure it? If it means “retrieved the DMARC record”, that’s a metric but not all that meaningful. I run Spamassassin so I probably would be part of that metric but I’m not doing anything with the result. For that matter, Spamassassin used to retrieve ADSP records.

If, on the other hand, it means that the recipient domain is acting on a DMARC-published policy, that would be meaningful but I’m not sure how one would measure that.

-Jim

---

From: Seth Blank <[email-masked]>
Date: Wed, 13 Apr 2022 20:54:32 -0700

On Wed, Apr 13, 2022 at 2:25 PM Jim Fenton <[email-masked]> wrote:

> Out of curiosity, what does “properly validate DMARC” mean and how do you
> measure it? If it means “retrieved the DMARC record”, that’s a metric but
> not all that meaningful. I run Spamassassin so I probably would be part of
> that metric but I’m not doing anything with the result. For that matter,
> Spamassassin used to retrieve ADSP records.
>
> If, on the other hand, it means that the recipient domain is acting on a
> DMARC-published policy, that would be meaningful but I’m not sure how one
> would measure that.
>

Yes, "properly validates DMARC" means the mailbox provider validates and
handles the message per RFC 7489. This is easy to measure, because there
aren't that many large mailbox providers, and most are a) public with how
many mailboxes they represent, b) public with the fact that they validate
DMARC, and c) (in nearly all the cases, sans Microsoft) send reports which
can be used to confirm the proper handling of messages per published policy.

S

--

---

From: Alessandro Vesely <[email-masked]>
Date: Thu, 14 Apr 2022 11:55:38 +0200

>>> Policies: https://dmarc.org/2022/03/dmarc-policies-up-84-for-2021/

Those are domains which publish a policy.  An alternative graph here:
https://dmarc.org/stats/farsight/dmarc/

The number published by a European research is about the double.  They say that 
8,129,795 out of 246,425,997 domains exhibit a DMARC record (3.3%).
https://data.europa.eu/doi/10.2759/473317 (chapter 17, table 31).

Dmarcian has a Fortune 100, 2021/2022, per-policy statistics:
https://dmarcian.com/fortune-100-dmarc-policies/
In their home page, they count 1,776,500 monitored domains (35.7% or 21.8%).

Counting domains is undoubtedly easier than counting validated mailboxes.  My 
personal domain count, since one year ago, shows 9.3% domains having a DMARC 
record; 4.1% of the latter having "dmarcian.com" in their rua.  (However, I, 
for one, send ag reports to Dmarcian without publishing their email address on 
my DMARC record.)

>>> I believe) have historically tracked and published that. [...]
>>

I don't think there is any available method to _check_ that a mail server acts 
on published policies correctly, including alignment considerations, sp= and 
np=.  Checking also the accuracy of their aggregate reports would be a further 
step.  Measuring how many domains do so seems to me to be beyond reach.

> can be used to confirm the proper handling of messages per published policy.

I'd call that a rough estimate, no?

Best
Ale
--