TLDR Tech / InfoSec
Email Security: An Enablement Journey, Not a Maturity Ladder
This article, referencing Majestic Million data that shows 57.1% of mail-enabled domains publish DMARC but only approximately 26% enforce it, re-frames email authentication as a sequence of unlocked capabilities rather than a rigid maturity ladder. It identifies the critical failure point as the transition from DMARC p=none (reporting) to enforcement, where 74% of organizations become stuck. Practical guidance includes setting DMARC to p=reject to achieve a 70-85% reduction in domain spoofing. Subsequently, it recommends adding MTA-STS (which has only 1.1% adoption despite requiring minimal effort), along with TLS-RPT and CAA for inbound SMTP encryption and control over certificate issuance, as these measures offer the highest effort-to-impact ratio for most organizations. DNSSEC (6.75% adoption) and DANE (0.73% adoption) are presented as relevant for regulatory compliance or specialized threat models, not universal requirements. The concluding argument emphasizes prioritizing defenses against actual attack vectors such as weak passwords, open directories, and live spoofing, before focusing on less probable threats like CA-compromise Man-in-the-Middle attacks.
Read the full story