> The core problem is that the real need of email end users need is a way of determining whether or not to trust a given sender.

Which is only the core problem because dmarc fixed the other core problem of figuring out who the given sender is.

DMARC does not solve everything, but it does make other solutions more effective.

My work email is Outlook, which is horribly broken and terrible to use. I have a rule configured to "re-send" all my mail to a different account where I read it with a usable MUA. Unfortunately this seems to break DMARC for external mail as now an email from e.g. user@example.com appears to have been sent by outlook.com.

My domain is very low traffic but, I just looked through my admin email account and opendmarc has rejected 18 attempts by spammers just this past week. More were rejected by my domain's DMARC policy.

^ this

Additionally, I would probably guess correctly that almost all spam comes from rotating ASNs these days. Aka from companies that do "growth marketing" or other bullshit that isn't a valid business but just... spamming people.

A lot of the domains that fall through the cracks for single-spam-campaigns have been taken over by botnet campaigns, so the actual owners of said domains probably don't know that their website is spamming everyone else.

But the major providers are the culprit, too, here. Gmail, hotmail, microsoft o365, mailgun ... they all don't even enforce SSL from server to server, and let through "sendmail" like spam because the spammers are paying customers to them.

Source: I am maintaining antispam [1] which I am using to combat spam, phishing, and malware campaigns targeting my customer networks.

[1] https://github.com/cookiengineer/antispam

I take the opposite approach, I refuse to whitelist domains. When someone internal complains I send a notice to their contact on the other end (CCing the internal recipient) saying their email is misconfigured and ask them to put me in touch with their IT department to help them fix it. I use a script to do some DNS lookups and write the email for me. I have about a 50% success rate getting them to fix it.

Also consider (using your example domain):

  *.mydomain.io. TXT "v=spf1 -all"

I use postfix and the recipient_access file to control email to my domains which use little email, so the domains are able to process standard email:

admin@example.com OK postmaster@example.com OK abuse@example.com OK webmaster@example.com OK hostmaster@example.com OK info@example.com OK example.com REJECT example.com

Yes, email is just completely broken. It's not private, sender identification is mediocre at best (and nonexistent without things like DMARC and SPF), and all the kludges thrown up make self-hosting harder. Spam has zero cost basically also. Nobody trusts email anymore for anything confidential, it's become a clumsy notification service "come check our portal for your real email".

It's time for a new protocol with end to end encryption and sender verification built-in. That shouldn't be as hard as it sounds, because at the time when email was invented the internet was very different. Connections were intermittent, for example I would retrieve my email once a day with UUCP (and some other people would use batched-SMTP). Which means you could not rely on the sending and receiving server being able to communicate directly. In this day and age this is possible and that direct communication opens up a lot of better crypto like key generation algorithms which require both parties to be online at the same time.

The problem is, is you don't allow corpos you will break 95% of mainstream people's usecases. So I think this is a non-starter, unfortunately, though it is a lofty goal.

You can do this right now, and you don't even need to fork anything. E-mail is an internet scale protocol that's not owned or ownable, except by convention. Since you specifically want to cut out Google, and their attempts to capture E-mail are what makes rolling your own E-mail hard anyway, just go for it.

Depending on how hard you want to make it, you can slap all the parts together yourself or use something like Zimbra, Mailcow, iRedMail, mail-in-a-box.

The advantage over a fork, whatever specifically that means, is any service that needs E-mail as an identity verification, still works.

What do you mean “fork”? Just buy a domain and install an email server.

You can already do this without changing anything. Just set your corporate mailserver to not accept mail from common community email providers. There's a reason nobody does this, and it's because it's a bad idea.

There is so much crossover between personal email and corporate email.

LLMs are very good at helping you manage DMARC/DNS related configuration, even as a non-expert. I used it to develop custom DMARC report processing app that: 1. sucks in reports sent to our dmarc inbox into a sqlite db, 2. displays the results in a web page. The reports queue up in the mailbox and I open and start the app once a month to check the status. The agent also also reviewed the state of email-related DNS records, describe what needs to change, including how and why, and verify changes after the fact to ensure they are correct.

Some changes I made at the direction of an agent: fix domainkeys CNAMEs for M365, rotate M365 dkim keys that haven't been rotated for over a decade, fix broken spf record formatting.

My biggest issue is that squarespace refuses to enable dkim signing for transactional emails that they send for us (order/shipping confirmation etc). The email sending service they use (socketlabs) supports it but they are not interested in enabling the feature, so I can't lock down our dmarc. I guess that means squarespace is not a good fit for our needs; it's just disappointing that we have to move to a different platform again for technical reasons that are solvable with a dashboard switch.

Email providers do have an automated way of handling abuse. Send the message to abuse@provider and they automatically ignore it. =)

It's ironic that I set everything up correctly on my self hosted domain and still end up in spam because of my low volume.

I even go to the trouble of registering in their Postmaster Tools and clogging up my DNS with their verification tokens all for the tools to tell me I don't send enough mail while they happily pass what little mail I send straight to spam.

  Not enough outgoing email
  You haven't sent enough email to personal Gmail (@gmail.com) accounts to determine deliverability status for your domain and messages.

Guess it doesn't help that as I look today the Postmaster Tools dashboard shows "Last updated Sun, Apr 26, at 9:30 AM."

Then on the other hand Google can flood me with spam filled Google Calendar Invites and Google Drive Share notifications, all fully DKIM signed because they are coming out of those services, all day long.

Microsoft have also recently changed their Smart Network Data Service (SNDS) so now only my cloud provider can access the console as they only allow verification to the owner of the whole ASN block you're under. I can't access detail about my domain anymore, and still my mail goes to junk. Unless you own a chunk of IPv4 ASN range you're out of luck. IPv6? Nope, not at Microsoft. "Please note that IPv6 is not currently supported." [1]

[1]: https://substrate.office.com/ip-domain-management-snds/SNDS/...

The reports are kind of useful when first enabling, if you want to get warnings about non-compliant mail, but after you're established, they're not really useful, so you should turn reports off, but you can do that without turning off the whole thing.

There are lots of free tools that automatically analyze the reports for you (you send it to them, instead of yourself).

But if you send all emails for your domain from one email server, you could just disable rua reporting. The reports are mainly useful to see whether you have some misconfigired email server somewhere that causes (or will cause) dropped emails. That can easily happen if you send some email from your own server, some via sendgrid, some via some marketing tool, and start to lose track of them. But for a personal email server, that's not common.

68.4% still don't enforce it, i.e. adoption is just over 30%, not nearly 70%.

You misunderstood, it's 31.6% actually.

DMARC is essentially an opt-in to strict mode. Primarily it prevents other people from forging email to look like it is coming from you. The goal of dmarc is to prevent other people from impersonating you.

> What would be the benefit of setting up DMARC on top?

Some mail providers will junk your mail if you don't have a reject/quarantine DMARC policy because you're seen as enabling the spammers so everything out of your domain must be punished.

The biggest benefit I saw in a small domain was greatly reduced backscatter spam. Before someone’d randomly make up a billion emails on my domain and send “from” them, and I’d get various out of office replies, etc (catch all) - that basically never happens anymore.

Because if someone spoofs an email coming from your domain DMARC tells the receiver what to do with the spoofed email.