Subject: [dmarc-ietf] DMARC Coverage

From: Scott Kitterman <[email-masked]>
Date: Sat, 13 Apr 2019 17:12:20 -0400

A couple of days ago I sent a single message to a reasonably large mailing 
list (spf-help, email oriented - so likely not representative, but it's a data 
point).  Since I am a list owner, I know how many subscribers there are and 
from my DMARC feedback, I know how many times that single message got 
reported.

43% of them showed up in my DMARC feedback, so that's at least one data point 
on breadth of coverage for DMARC feedback.

To do this (at least the way I did it), you need to send a single message in a 
reporting period to an email list that does not re-write from and for which 
you know how many subscribers there are.

I'm curious what kind of numbers other might be able to come up with.

Scott K

---

From: Dotzero <[email-masked]>
Date: Sun, 14 Apr 2019 09:38:42 -0400

Scott, it's almost certainly an undercount as there are domains which
validate for DMARC but do not send reports.

Michael Hammer

On Sat, Apr 13, 2019 at 5:12 PM Scott Kitterman <[email-masked]>
wrote:

> _______________________________________________
> dmarc mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dmarc
>

---

From: Hector Santos <[email-masked]>
Date: Mon, 15 Apr 2019 11:44:33 -0400

> validate for DMARC but do not send reports.

+1, without a doubt.

-- 
HLS

---

From: "Kurt Andersen (b)" <[email-masked]>
Date: Mon, 15 Apr 2019 09:51:49 -0700

> validate for DMARC but do not send reports.

Not sure why you would say that since he was looking at "coverage for DMARC
feedback". Not necessarily for validation.

--Kurt

---

From: Ian Levy <[email-masked]>
Date: Wed, 17 Apr 2019 17:47:18 +0000

We've done something slightly different (because it's data we have to hand) but I think it's still comparable.

We looked at the all messages sent from ncsc.gov.uk in March 2019. In total, we sent 67,962 emails and received DMARC reports for  8,657 emails, about 12.5%. Now, I think our main correspondents are likely to be in gov.uk and we know there's a lot of Office 365 and older on-prem solutions that don't report, so it's going to be artificially low.

Possibly more interesting is the data from the Gov.UK Notify service, which sends mail from the notifications.service.gov.uk domain. Notify is the platform for government to send notifications to people and it publishes its performance data, for example for March 2019 at https://www.gov.uk/performance/govuk-notify/notifications-by-type#from=2019-03-01T00:00:00Z&to=2019-03-01T00:00:00Z
This shows that Notify sent 36,301,537 emails in March and we received reporting of 13,671,108 emails, about 37.9%.

Notify sends messages to a much broader set of receivers so is likely to be more representative and therefore useful statistically.

<hint mode='subtle'>
I'd be really interested in what happens to these numbers if Microsoft start sending DMARC reports, for both O365 and their consumer platforms.
</hint>

Ta.

I.

--
Dr Ian Levy
Technical Director
National Cyber Security Centre
[email-masked]

Staff Officer : Kate Atkins, [email-masked]

(I work stupid hours and weird times - that doesn't mean you have to. If this arrives outside your normal working hours, don't feel compelled to respond immediately!)

-----Original Message-----
From: dmarc <[email-masked]> On Behalf Of Scott Kitterman
Sent: 13 April 2019 22:12
To: [email-masked]
Subject: [dmarc-ietf] DMARC Coverage

A couple of days ago I sent a single message to a reasonably large mailing list (spf-help, email oriented - so likely not representative, but it's a data point).  Since I am a list owner, I know how many subscribers there are and from my DMARC feedback, I know how many times that single message got reported.

43% of them showed up in my DMARC feedback, so that's at least one data point on breadth of coverage for DMARC feedback.

To do this (at least the way I did it), you need to send a single message in a reporting period to an email list that does not re-write from and for which you know how many subscribers there are.

Scott K

_______________________________________________
dmarc mailing list
[email-masked]
https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fdmarc&amp;data=02%7C01%7Cian.levy%40ncsc.gov.uk%7C14b11e326d154e893be508d6c054c2b9%7C14aa5744ece1474ea2d734f46dda64a1%7C0%7C0%7C636907867621729087&amp;sdata=cpa%2BmnPs5ClQ1ruPwExr6qwOfqzpb1WWkJUwm4%2B5p7M%3D&amp;reserved=0
This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation. Refer any FOIA queries to [email-masked]