upvote
That is not true. Reports are just one of the features of DMARC. The policy which allows you to instruct senders what to do with unauthenticated emails is the much more relevant part an when the receiver follows it, it very much does prevent spoofing.
reply
And what should a provider do if the dmarc policy says that none of the dkim or dmarc records should matter? What was the point of spf saying what servers could send, or dkim specifying signing keys?

"Oh, please, don't ignore the other two ways I told you to ignore unauthorized messages" shouldn't need a knob.

reply
You are a mail server.

You get an email without a DKIM signature from me.

Is that because I do not use DKIM and do not sign my emails or because the message is forged and not from me at all?

You cannot tell. There is a single SPF record that you can look up to see if SPF is configured. It's just a TXT record on the domain. But there is no standard DKIM record. A DKIM signed email tells you what key identifier it used and you have to use that to look up the DKIM key at <key identifier>._domainkey.<sender domain>. When the email has no DKIM signature you cannot tell if that's because the sender domain does not use DKIM or if it does have a DKIM key record but it was not used, potentially because the email is forged.

reply
Right. And if you mandate dkim, as seems to be the case with servers that demand dmarc, what's the issue? You reject the emails where dkim isn't set.

Or do you think it's critical to support mail that doesn't have dkim?

reply
You'll have a bad time if you just drop all emails without DKIM. There are many large senders that do not care about well established email standards and you will drop important emails.
reply
These are the same senders that are correctly configuring DMARC?
reply
deleted
reply
DMARC gives you 20 reminders that you have sent an email, just incase you had forgotten.
reply
deleted
reply