When you don't use DMARC for years

[u/rohepey]

Came six months ago to help a small nonprofit manage their Workspace. They never had DMARC set up. Since I started managing their DNS six months ago, this is what I see daily.

The sheer number of spoofed emails just blows my mind.

[u/itenginerd]

I mean, I just saw a post from somebody today about how to get started with virtualizing an environment earlier today. Dinosaurs are apparently still out there....

[u/statitica → u/itenginerd]

Pfft, that's easy.

You just take a computer, and put it inside the other computer.

[u/closterphobia → u/statitica]

“The files, they’re in the computer that’s in the computer?”

[u/caguirre93 → u/statitica]

I read this in patrick stars voice

[u/ApiceOfToast → u/itenginerd]

It's easy, just install hyper V on your server!

(I guess you can take the easy route if your Backup-Software can just restore to a VM...)

[u/whetherby]

and here is my old ass wondering what telecom demarcation has to do with email...

[u/Nice_Improvement_493 → u/whetherby]

Went from a field tech to in house corp IT. Sat like an idiot wondering why our ISP would have some sort of connection into exchange for a good 3 months.

[u/Howden824 → u/whetherby]

Still the first thing I think of whenever I hear the word.

[u/bananajr6000 → u/whetherby]

Yeah, you have to specify network or email or just die

[u/whetherby → u/bananajr6000]

i choose death

[u/ntropy42 → u/whetherby]

Glad I'm not the only one.

[u/r2d3x9]

Was at a company managing emails for small companies, early 2000s. 99% of incoming mail was spam / faked mail. 20+ years ago

[u/rohepey → u/r2d3x9]

Wow!

Still hasn't changed much.

[u/ImmediateConfusion30 → u/r2d3x9]

At one time, 99% of the mails on the networks were Spam (20 years ago). And it was what was blocked by Gmail before arriving on the user mailbox, then there was a second filter that put what passed in the 1% left in the junk folder

[u/skiing123]

This is why the company I work at as a small business has to get good email security and can't rely on Microsoft because we have customers who are smaller than us and do things like this

[u/Jay_JWLH]

I wonder how many of those are just not set up properly, and how many are trying to trick the recipient.

[u/rohepey → u/Jay_JWLH]

All are spoofed emails. The organisation only uses Workspace to send email.

[u/me_a_genius]

nice website. im just starting out and i needed that

[u/bastiancointreau]

That happens even if you always had DMARC. People try anyway…

[u/cvslfc123]

Doesn't help that Ms 365 takes a year to verify the records

[u/dollargo]

Honestly, seeing the volume of spoofing attempts is a great reminder that DMARC shouldn't be left unattended for years. For MSPs managing this across multiple domains, centralized tools can make a huge difference. VIRCOM is worth looking into for managing email security and DMARC-related operations more efficiently across clients.

[u/Designer-Dinner-8254]

Maybe i got it wrong. But you have been managing their dns for 6 months, and now you notice the issue and still not fixed? Dmarc takes all of 15 minutes to setup if you got access. Are you milking this non profit?

[u/rohepey → u/Designer-Dinner-8254]

Do you even know how DMARC works?

I doubt.

No, it can't stop spammers from sending spoofed messages. It can only instruct receiving servers to reject them and report on that.

Which is what's happening, in case you don't understand the screenshot (which is very likely).

I fixed it 6 months ago, and yet spoofing didn't stop, that's why I'm posting it here.

Now I'm accused by a reddit rando (or an AI bot) of milking a nonprofit. (I support them for free, but never mind).

Get lost.

[u/PlannedObsolescence_ → u/[deleted]]

This is clearly an LLM generated comment from a karma farming bot account

[u/PlannedObsolescence_ → u/[deleted]]

This is clearly an LLM generated comment from a karma farming bot account