https://blogs.damiendye.uk/en/tags/dmarc/ Recent content in Dmarc on Damien Dye's Blog Hugo en-GB Thu, 22 Oct 2026 19:00:00 +0100 https://blogs.damiendye.uk/en/email/why-every-mail-setting-has-to-be-right/ Thu, 22 Oct 2026 19:00:00 +0100 https://blogs.damiendye.uk/en/email/why-every-mail-setting-has-to-be-right/ Email transport security fails open: a stripped STARTTLS, a stale TLSA record, an unsigned zone or a p=none policy, and mail drops to cleartext or forgeable delivery with nothing telling you. A lab man-in-the-middle, the seven settings and how each fails when wrong, DNSSEC up to DANE, and a census of the banks, providers and CAs. https://blogs.damiendye.uk/en/email/microsoft-365-the-fisher-price-it-edition/ Thu, 22 Oct 2026 18:45:00 +0100 https://blogs.damiendye.uk/en/email/microsoft-365-the-fisher-price-it-edition/ The house rules held against Exchange Online, from Microsoft's own docs and read-only DNS. No tenant-wide require-TLS switch, no rejecting an SPF or DKIM failure, DNSSEC not planned for the mail host every tenant uses, and the NCSC's own MX has no IPv6. What it lets you turn on, what it will not, and where its own docs disagree. https://blogs.damiendye.uk/en/email/stalwart-dane-and-the-rest-built-in/ Thu, 22 Oct 2026 18:40:00 +0100 https://blogs.damiendye.uk/en/email/stalwart-dane-and-the-rest-built-in/ Stalwart puts SMTP, IMAP, SPF, DKIM, DMARC, DANE, MTA-STS and a spam filter in one binary, which is the appeal and the catch. The same house rules as the Postfix build, enforced here, with every reply captured in the lab, the permissive defaults it ships with, the four places a rule has to go, and the behaviours that need working around.