Hacker News new | ask | show | jobs
by taskforcegemini 878 days ago
The DMARC requirement only applies to senders who send at least 5000 e-mails per day to gmail-recipients.

I'm not a fan of DMARC. SPF and DKIM already do their job well enough. Then people add DMARC with "p=none" just to tick their "have DMARC" box. Even google suggests a policy of "none" is ok, but doesn't mention that this means SPF and DKIM will be ignored.
2 comments
pul 871 days ago
SPF and DKIM are not enough to harden email. Email can still be spoofed through a loophole in both specs.

See https://www.nslookup.io/learning/dmarc-a-practical-guide/

link
taskforcegemini 864 days ago
which loophole? I didn't see it mentioned in the article.

and this quote is not correct:

> Note that an email doesn't need to pass both DKIM and SPF. Just one is enough to validate an email.

Unless it was said in regards to DMARC, it usually depends on the mailfilter of the receiver. If it was said in regards to DMARC then it's just another point why DMARC is bad.

link
johnea 878 days ago
That 5000 email/day limit should prevent most small business/personal servers from being affected...
link