Re: [dmarc-ietf] DMARC Coverage

[Ian Levy <[e-mail]>]

We've done something slightly different (because it's data we have to hand) but I think it's still comparable.

We looked at the all messages sent from ncsc.gov.uk in March 2019. In total, we sent 67,962 emails and received DMARC reports for  8,657 emails, about 12.5%. Now, I think our main correspondents are likely to be in gov.uk and we know there's a lot of Office 365 and older on-prem solutions that don't report, so it's going to be artificially low.

Possibly more interesting is the data from the Gov.UK Notify service, which sends mail from the notifications.service.gov.uk domain. Notify is the platform for government to send notifications to people and it publishes its performance data, for example for March 2019 at https://www.gov.uk/performance/govuk-notify/notifications-by-type#from=2019-03-01T00:00:00Z&to=2019-03-01T00:00:00Z
This shows that Notify sent 36,301,537 emails in March and we received reporting of 13,671,108 emails, about 37.9%.

Notify sends messages to a much broader set of receivers so is likely to be more representative and therefore useful statistically.

<hint mode='subtle'>
I'd be really interested in what happens to these numbers if Microsoft start sending DMARC reports, for both O365 and their consumer platforms.
</hint>

Ta.

I.

--
Dr Ian Levy
Technical Director
National Cyber Security Centre
[e-mail]

Staff Officer : Kate Atkins, [e-mail]

(I work stupid hours and weird times - that doesn't mean you have to. If this arrives outside your normal working hours, don't feel compelled to respond immediately!)

-----Original Message-----
From: dmarc <[e-mail]> On Behalf Of Scott Kitterman
Sent: 13 April 2019 22:12
To: [e-mail]
Subject: [dmarc-ietf] DMARC Coverage

A couple of days ago I sent a single message to a reasonably large mailing list (spf-help, email oriented - so likely not representative, but it's a data point).  Since I am a list owner, I know how many subscribers there are and from my DMARC feedback, I know how many times that single message got reported.

43% of them showed up in my DMARC feedback, so that's at least one data point on breadth of coverage for DMARC feedback.

To do this (at least the way I did it), you need to send a single message in a reporting period to an email list that does not re-write from and for which you know how many subscribers there are.

I'm curious what kind of numbers other might be able to come up with.

Scott K

_______________________________________________
dmarc mailing list
[e-mail]
https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fdmarc&amp;data=02%7C01%7Cian.levy%40ncsc.gov.uk%7C14b11e326d154e893be508d6c054c2b9%7C14aa5744ece1474ea2d734f46dda64a1%7C0%7C0%7C636907867621729087&amp;sdata=cpa%2BmnPs5ClQ1ruPwExr6qwOfqzpb1WWkJUwm4%2B5p7M%3D&amp;reserved=0
This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation. Refer any FOIA queries to [e-mail]