The primary purpose of DMARC is to prevent impersonation not to prevent spam. I own a domain, I implement DMARC to make sure others know when email from my domain is legitimately from my domain.
Then you don't deal with email in the real world. DMARC prevents legitimate emails from people in the real world from being delivered because people make mistakes with their email systems. Passing DMARC is not a signal that the email isn't legitimate; it's merely a sign that someone correctly set up their mail server to modern standards. The email might be an impersonation, or not. There's no way to know.
DMARC does absolutely nothing to prevent the kind of impersonation that occurs in the real world. It doesn't block homoglyphs or or typo-squatting or all the other forms impersonation that matter. It has failed at preventing impersonation.
Just a few days ago I had a phishing email from an elderly woman I had previously done some work for. The message passed DMARC and everything else, and the domain it was sent from was valid. But it was not legitimate; it was an impersonation of her which became obvious once the content was read.
DMARC is noise, not signal. It has to be ignored in the real world as it provides virtually no value beyond blocking emails pretty randomly because someone made a mistake when rotating their DKIM keys or one of a million other mistakes that do happen.
That saying is bullshit. The purpose of a system is, by definition, what it is intended to do, not what it does. You can judge efficacy by the results, but not the purpose.
No, the entire purpose of the POSIWID principle is to refute what you just said. Do read the wikipedia page linked above. You called it out yourself when you said "by definition" - there is definition, and then there is reality, and they need not align.
Wish I didn't have to log in to reddit to read that post. RIP useful reddit links.
edit: looks like I had an extension that was redirecting to old.reddit.com, and it was old reddit that required login. Though when I turned that extension off, I got a "blocked by reddit security" error. ugggh.
Yes and no. DKIM signs part of the envelope to help recipients detect alteration (by verifying authenticity), SPF locks down the permissible origins for the sender. SPF is in itself imperfect and can in some situations be exploited on open-access shared systems. If the two are used in concert they offer decent protection.
Using both has to be done very carefully, because a positive result from the weaker one (SPF) will override a negative result from the stronger one (DKIM). You should maximally use DKIM and minimally use SPF. Ideally, you should not use SPF at all, but there are some senders that still don't support DKIM.
Many email providers and third party security tools default settings automatically bounce or block SPF failures, no matter what DKIM says... so no, not using SPF completely is a bad idea.
Using it minimally is correct, thou. Route outbound mail through as few controlled relays as possible so your SPF record only needs to list infrastructure you actually *own*, rather than growing it every time a new tool needs to send mail.
I have seen way too many clients almost hit the char limit in a TXT record
SPF failures overriding DKIM successes is a direct violation of RFC 7489 section 4.2 [1]. I have never observed such behavior in the wild, though my experience may be more limited than yours. There are two possible explanations anyway, one is that the DMARC record was missing or misconfigured, the other is that the DKIM check did not actually succeed even though you had reason to believe it should have (e.g., misaligned sender domain, invalid/stale/rotated key, etc.).
I would certainly agree that DKIM is harder to get right. However, the TXT record data size limit is surmountable. You can either use EC algorithms, which have much shorter keys, or stick with e.g. RSA and its very long keys, but span them across multiple 255-byte record data chunks. That having been said, I still think DNS providers should do more to make configuring DKIM easier.
Ultimately, if you have SPF and DKIM set up such that both cover all senders, then you are just using SPF. It is the simpler and more forgiving mechanism, so its broad-scoped successes will always swallow DKIM in practice. The only reason I can think of to do this anyway is if you suspect your email provider will change IPs on you and they don't provide their own SPF record, but if that were the case, they are basically telling you not to use SPF in the first place.
EDIT: RFC 7489 was superseded by RFCs 9989-9901 rather recently. Nevertheless, the definition of success, now given in RFC 9989 section 5.3.5 [2], remains the same.
The "logical OR" of DMARC is absolutely a glaring caveat. I run my own MX and would personally under no circumstance omit SPF, because I consider neither SPF nor DKIM complicated enough to warrant consideration.
This is true, and yet DMARC v1 does not require you to use them in concert. Either one (a valid DKIM-signed message with sender alignment or a message that passes SPF checks with sender alignment) is enough to pass DMARC.
DMARC does absolutely nothing to prevent the kind of impersonation that occurs in the real world. It doesn't block homoglyphs or or typo-squatting or all the other forms impersonation that matter. It has failed at preventing impersonation.
Just a few days ago I had a phishing email from an elderly woman I had previously done some work for. The message passed DMARC and everything else, and the domain it was sent from was valid. But it was not legitimate; it was an impersonation of her which became obvious once the content was read.
DMARC is noise, not signal. It has to be ignored in the real world as it provides virtually no value beyond blocking emails pretty randomly because someone made a mistake when rotating their DKIM keys or one of a million other mistakes that do happen.