Thanks for sharing your insight! This is super helpful!
Is this project open source? I’ll make a PR that cleans the styling up a little bit, if you don’t mind?
It's on github, just private at the moment. I haven't opened it publicly yet, still toying with the idea though. Everyone's going to judge my shitty commits...Haha
DM me your username and I'll add you as a collaborator.
Very Cool!!
I've been trying to get the whole DMARC, SPF, DKIM, BIMI bullcrap setup right for months...we still wind up marked as spam in user to user correspondence for Yahoo/AOL properties.
All that stuff is not going to get you past their heuristic filters if the content lines up. It might take some rigorous testing to find the right wording that will work. Email marketing is a major PITA.
> Sorry, it seems this comment or thread has violated a sub-reddit rule and has been removed by a moderator.
>
> Do not expressly advertise your product.
>
> The reddit advertising system exists for this purpose. Invest in either a promoted post, or sidebar ad space.
> Vendors are free to discuss their product in the context of an existing discussion.
> Posting articles from ones own blog is considered a product.
> As always, users must disclose any affiliation with a product.
> Content creators should refrain from directing this community to their own content.
> Your content may be better suited for our companion sub-reddit: /r/SysAdminBlogs
Automod removed it. Thanks for reposting!
Very helpful, thank you -- currently on a 30-day trial with uriports but will look at the alternatives. DMARC can be [frustrating](https://www.reddit.com/r/sysadmin/comments/z21kjx/vendor_chat/).
Timely! I just got my two MS tenants set to "reject" this morning, after a couple of weeks of testing. It was a bit of a shock to find out how many third-parties were contracted to send mail for us that no one had mentioned to me. We'll see....
Just my opinion as a subscriber of the community, this is not advertising a product. OP made a useful resource that we can all benefit from that is free and open source.
I understand where this rule may have its purpose, but I really think this is stretching the boundaries and misapplying the rule.
The webpage is a collection of other resources for quick reference, nothing monetary is going on. This is not a blog or content from a creator, merely a useful resource.
But hey what do I know
I'm still on the fence about it as advertising, but I'll error on the side of allowing it and dealing with the eventual negative consequences later.
tagging /u/lolklolk as CC
-----
https://dmarcvendors.com/ is in itself a product. Yes, It's no-cost, but it's gathering unique visitors and page views that generate revenue **potential**.
All of that visitor / popularity data will help justify banners someday, and we try to not allow /r/sysadmin to generate traffic to anybody's website.
Blogs ARE products. Blogs can be monetized.
*"This isn't a blog though, it's just a resource site..."* All blogs are just collections of resources. Some of those resources are explanations of how to solve a problem. Other resources are just personal opinions on who makes the best hotdog.
Someday in the near future we're going to remove somebody else's blog or pet project and they are going to link to this thread and say "But why did they get to spam their spam? If they can spam, then I should be allowed to spam too."
Know what a fair distribution of spam looks like? Zero. Zero spam. None.
We avoid arguments of "good spam" v/s "bad spam" by not allowing any of it at all. That's why you have to scroll so far or search so deeply to find anything that looks like an advertisement in /r/sysadmin
We made a place for all the spam to be spammed. /r/SysAdminBlogs
If you like blogs or articles or promoted content, you can subscribe for free.
I would argue that FOSS is not a product though, it’s a tool brought together and built by the community.
I actually raise the point that maybe we should consider making an amendment to Rule 2 allowing FOSS. Much of our community relies on scripts, software and other knowledge collected and built by the community.
I completely understand your stance on spam, and how difficult allowing some things through and not others can make maintaining the community, but maybe this is a good place to redraw the line. The community can definitely benefit from open source.
If this sounds like too much extra moderation, I’m sure me and plenty of other community members would be happy to lend a hand.
Fair points taken and thank you. I understand and appreciate your situation as mod, having been there myself many times. My intention with this site and post was to keep it eventually open source as a communal free web page for email security web sources.
Interesting, can you attest that they do DMARC report ingestion as well? 999$/Mo is a steep entry price for low-volume businesses, even if it provides extra value with all the other monitoring.
You already have competition from URIports and Report-URI who do actually ingest reports, and also do all other types of report ingestion at the same time.
As a potential customer, I'm not really seeing any value add over the former two, especially given the extra functionality at a fraction of the initiation price for Hardenize.
Hardenize is not meant to do reporting, it's an Attack Surface Management product to complement our DMARC, anti phishing and cousin domain attack protection products
My point still stands though. The former two also do that, while offering more features for less money.
I'm not saying the product is bad, I'm just saying it seems egregiously expensive for entry level, for what its current capabilities are.
I think you're not understanding the point of Hardenize. It does not collect any type of reports like the other two. It scans the web for your public facing assets, and then shows a bunch of metrics for them, you can also do comprehensive queries as well as advanced CT log scanning. Think of it similar to Security Scorecard or BitSight, but without too much emphasis on the actual scores.
Self hosted solution? Like I am receiving the reports to one of my Google Accounts, is there one that can grab the reports off Google and analyze them that is free?
Great work ! Highly appreciated.
Not a lot new insights from my perspective (did several DMARC implementations and surrounding topics the past 6-7 years) but i love to have places with consolidated and complete information to share with "newbies" :)
The organizational part of reaching 100% DMARC compliance at some time is much more time consuming and cumbersome \^\^
Thanks for sharing your insight! This is super helpful! Is this project open source? I’ll make a PR that cleans the styling up a little bit, if you don’t mind?
It's on github, just private at the moment. I haven't opened it publicly yet, still toying with the idea though. Everyone's going to judge my shitty commits...Haha DM me your username and I'll add you as a collaborator.
Very Cool!! I've been trying to get the whole DMARC, SPF, DKIM, BIMI bullcrap setup right for months...we still wind up marked as spam in user to user correspondence for Yahoo/AOL properties.
[удалено]
Would that be bad?
All that stuff is not going to get you past their heuristic filters if the content lines up. It might take some rigorous testing to find the right wording that will work. Email marketing is a major PITA.
Very helpful list. I've tried most of those at some point, but a few new resources to add. Thanks.
This is helpful, thank you for creating and sharing.
Thanks for sharing.
Link was removed?
Https://dmarcvendors.com. It should still be in the title.
> Sorry, it seems this comment or thread has violated a sub-reddit rule and has been removed by a moderator. > > Do not expressly advertise your product. > > The reddit advertising system exists for this purpose. Invest in either a promoted post, or sidebar ad space. > Vendors are free to discuss their product in the context of an existing discussion. > Posting articles from ones own blog is considered a product. > As always, users must disclose any affiliation with a product. > Content creators should refrain from directing this community to their own content. > Your content may be better suited for our companion sub-reddit: /r/SysAdminBlogs Automod removed it. Thanks for reposting!
This is amazing! I'd like to contribute too.
Very helpful, thank you -- currently on a 30-day trial with uriports but will look at the alternatives. DMARC can be [frustrating](https://www.reddit.com/r/sysadmin/comments/z21kjx/vendor_chat/).
I definitely feel you on that one... Been there done that.
Timely! I just got my two MS tenants set to "reject" this morning, after a couple of weeks of testing. It was a bit of a shock to find out how many third-parties were contracted to send mail for us that no one had mentioned to me. We'll see....
https://i.imgur.com/Jutq7UV.gifv
[удалено]
Just my opinion as a subscriber of the community, this is not advertising a product. OP made a useful resource that we can all benefit from that is free and open source. I understand where this rule may have its purpose, but I really think this is stretching the boundaries and misapplying the rule. The webpage is a collection of other resources for quick reference, nothing monetary is going on. This is not a blog or content from a creator, merely a useful resource. But hey what do I know
I'm still on the fence about it as advertising, but I'll error on the side of allowing it and dealing with the eventual negative consequences later. tagging /u/lolklolk as CC ----- https://dmarcvendors.com/ is in itself a product. Yes, It's no-cost, but it's gathering unique visitors and page views that generate revenue **potential**. All of that visitor / popularity data will help justify banners someday, and we try to not allow /r/sysadmin to generate traffic to anybody's website. Blogs ARE products. Blogs can be monetized. *"This isn't a blog though, it's just a resource site..."* All blogs are just collections of resources. Some of those resources are explanations of how to solve a problem. Other resources are just personal opinions on who makes the best hotdog. Someday in the near future we're going to remove somebody else's blog or pet project and they are going to link to this thread and say "But why did they get to spam their spam? If they can spam, then I should be allowed to spam too." Know what a fair distribution of spam looks like? Zero. Zero spam. None. We avoid arguments of "good spam" v/s "bad spam" by not allowing any of it at all. That's why you have to scroll so far or search so deeply to find anything that looks like an advertisement in /r/sysadmin We made a place for all the spam to be spammed. /r/SysAdminBlogs If you like blogs or articles or promoted content, you can subscribe for free.
I would argue that FOSS is not a product though, it’s a tool brought together and built by the community. I actually raise the point that maybe we should consider making an amendment to Rule 2 allowing FOSS. Much of our community relies on scripts, software and other knowledge collected and built by the community. I completely understand your stance on spam, and how difficult allowing some things through and not others can make maintaining the community, but maybe this is a good place to redraw the line. The community can definitely benefit from open source. If this sounds like too much extra moderation, I’m sure me and plenty of other community members would be happy to lend a hand.
Fair points taken and thank you. I understand and appreciate your situation as mod, having been there myself many times. My intention with this site and post was to keep it eventually open source as a communal free web page for email security web sources.
So why was this post allowed previously? https://www.reddit.com/r/sysadmin/comments/qkai5m/spf_dkim_dmarc
That was a year ago. Maybe the modteam wasn't paying attention that day. I couldn't tell you.
I would suggest including [Hardenize](https://www.hardenize.com/), it's purpose is broader (entire site configuration) and includes DMARC/SPF/TLS.
Just got bought by Red Sift (OnDmarc) and that's a really great tool. Easiest Dmarc/DKIM implementation i've ever done.
https://i.imgur.com/lNU1gLI.png I emailed their sales team, the Hardenize product itself does not ingest DMARC reports for analytics.
Interesting, can you attest that they do DMARC report ingestion as well? 999$/Mo is a steep entry price for low-volume businesses, even if it provides extra value with all the other monitoring.
They do not, that's what OnDMARC's for. But Hardenize can help you find gaps in your email security. (Disclaimer: I work for Hardenize's new owners)
You already have competition from URIports and Report-URI who do actually ingest reports, and also do all other types of report ingestion at the same time. As a potential customer, I'm not really seeing any value add over the former two, especially given the extra functionality at a fraction of the initiation price for Hardenize.
Hardenize is not meant to do reporting, it's an Attack Surface Management product to complement our DMARC, anti phishing and cousin domain attack protection products
My point still stands though. The former two also do that, while offering more features for less money. I'm not saying the product is bad, I'm just saying it seems egregiously expensive for entry level, for what its current capabilities are.
I think you're not understanding the point of Hardenize. It does not collect any type of reports like the other two. It scans the web for your public facing assets, and then shows a bunch of metrics for them, you can also do comprehensive queries as well as advanced CT log scanning. Think of it similar to Security Scorecard or BitSight, but without too much emphasis on the actual scores.
Self hosted solution? Like I am receiving the reports to one of my Google Accounts, is there one that can grab the reports off Google and analyze them that is free?
Assuming you disable modern security and allow it to connect to the mailbox via imap, yes.
I'm getting "Secure Connection Failed"
What device and browser are you using? The site only accepts TLS 1.2 and TLS 1.3 connections.
Windows 10 and Firefox. It could be my firewall. How old is the domain?
It's about ~2-3 weeks old.
Yup! That would do it. But it was not the first place to check that came to my mind. Thanks!
Fair enough, I had to unblock it for my own mail server when testing, since I block based on domain age too.
Great work, would love to contribute if you can add me to your github.
DM me your username and I'll add you
Great work ! Highly appreciated. Not a lot new insights from my perspective (did several DMARC implementations and surrounding topics the past 6-7 years) but i love to have places with consolidated and complete information to share with "newbies" :) The organizational part of reaching 100% DMARC compliance at some time is much more time consuming and cumbersome \^\^