Spammers are better at SPF, DKIM, and DMARC than everyone else

The point of SPF/DKIM/DMARC is to bind emails to domains, so no more spoofing. It is naive to expect authentication alone can reduce spams.

To be fair, SPF saves mail.ru and outlook.com users from five, maybe six spam emails per month coming from my domain, based on DMARC reports. If those numbers scale to include every domain on the internet, that's a huge amount of spam being filtered out very easily and very early.

You'd think spammers would've learned to avoid SPF domains at the very least but they haven't, so despite SPF/DMARC/DKIM failing to get anyone out the spam folder, the technology is still catching spam bots.

Finally, a comment that understands the concepts instead of insolently ranting about how useless it is.

While it may or may not reduce spam, it has definitely (based on my personal experience) reduced the amount of spoofed phishing emails and backscatter spam emails to nearly nothing.

In the early-to-mid '10s, before SPF/DKIM/DMARC became the law of the email land, one had to be much, much more careful with phishing emails, checking the wording, the logos, etc, because 9 out of 10 of them appeared to come from the actual domain the email purported to be from. In the past several years (I honestly don't know exactly when the change happened; I don't get a huge amount of phishing emails), it's shifted so that the first thing to check is the sender address. Usually that turns out to be some nonsense string @gmail.com or some long garbled domain.

It feels similar to people conflating green https check marks in browsers and trustworthiness.

All of these technologies are basically DOA because of how fickle they are and for lack of support across the board. Most policies are set to not to deny.

DMARC is nice though. It won't stop spam. It won't stop spoofing. But you will know that someone somewhere is spamming people using your domain name. How awesome. :)

I never found the DMARC reports actionable, so I quickly turned them off. What do you do with the information?

Of course, even with hard fail spf and dmarc, I still see some bounces from spam where some server accepted the mail to deliver it elsewhere and the next server denies it, so the first server sends me a bounce.

DMARC reports are for you to be sure that you configured SPF/DKIM correctly, not asking you to do something with the spoofing senders (which you can do absolutely nothing about).

exactly!

Yeah, so have reports when you start, but once you get things set up correctly, turn off the reports. If you break things later, you should find out quickly when mail is refused, and you can turn on reports again, if you need to.