{"schema_version":"1.0","service":"Publicasta","type":"article","id":231,"slug":"dmarc_p_none_enforcement_gap_email_spoofing_2026_07_30","title":"DMARC p=none 是监控，不是保护","excerpt":"CipherCue 发现，68.4% 被检查的 company domains 仍未 enforce DMARC。解决办法不是恐慌或一行 DNS，而是 sender inventory、alignment，以及逐步转向 quarantine 或 reject。","language":"zh","default_language":"en","canonical_url":"https://publicasta.com/cybersecurity/dmarc_p_none_enforcement_gap_email_spoofing_2026_07_30?lang=zh","image":{"url":"https://publicasta.com/storage/projects/9/pages/231/2026/07/bb85c602-86e5-4f63-ab7e-017230fb9583.webp","alt":"DMARC email policy 从 monitoring 转向 quarantine 和 reject gates"},"publisher":{"id":9,"slug":"cybersecurity","name":"Cybersecurity Without Panic","url":"https://publicasta.com/cybersecurity"},"author":{"name":"Anton R"},"published_at":"2026-07-30T13:42:21+00:00","updated_at":"2026-07-30T13:42:21+00:00","content_markdown":"DMARC 记录有时看起来像 email security 的进展，但实际上几乎不阻止任何伪造邮件。CipherCue 的新数据正好说明了这一点：他们在 2026 年 4 月 14 日到 7 月 28 日检查了 67,336 个 company domains，其中 68.4% 要么没有 DMARC record，要么仍停在 `p=none`。\n\n ![DMARC email policy 从 monitoring 转向 quarantine 和 reject gates](https://publicasta.com/storage/projects/9/pages/231/2026/07/bb85c602-86e5-4f63-ab7e-017230fb9583.webp)\n\n 这不是新的 zero-day，而是一个没有完成的控制措施。DMARC 自 2012 年公开使用。2026 年 5 月，IETF 用 RFC 9989、RFC 9990 和 RFC 9991 取代了原来的 RFC 7489，核心协议现在是 Standards Track Proposed Standard。问题不在于没人知道 DMARC，而在于很多组织只做到“收报告”，没有走到“要求接收方拦截域名伪造”。\n\n DMARC 有用，但不是反 phishing 魔法。它主要处理 visible From address 中的 exact-domain spoofing。它不能阻止 lookalike domains、display-name spoofing、被攻陷的真实账户，也不能阻止来自大型平台且 authentication 有效的 phishing。即便如此，如果你的公司域名还能被直接伪造，攻击者就多了一条便宜路线。\n\n DMARC 建在 SPF 和 DKIM 之上。SPF 说明哪些邮件服务器可以代表域名发送。DKIM 用域名密钥签名邮件。DMARC 检查 authenticated identity 是否与 visible From domain 对齐，并告诉 receiving mail systems 在失败时应如何处理。\n\n 常见 policy 有三种。`p=none` 只监控并生成 reports。`p=quarantine` 要求把失败邮件当成可疑邮件处理。`p=reject` 要求拒收失败邮件。接收方仍有自己的判断，但差别很明显：`p=none` 是会写日志的报警器，不是锁上的门。\n\n CipherCue 的 snapshot 中，30,362 个 domains，也就是 45.1%，没有 DMARC record。在有记录的域名里，15,709 个是 `p=none`，10,258 个是 `p=quarantine`，10,963 个是 `p=reject`。CipherCue 把 `p=quarantine` 和 `p=reject` 算作 enforcement，因此 sample 中有 46,071 个 domains 是 non-enforcing。\n\n 这些数字需要谨慎解读。CipherCue 说这是它的 tracked entity set，不是全世界所有公司的统计代表样本。Hacker News 评论里也提出了合理问题：这些域名里有多少是 parked、inactive、send-only，或者没有正常 MX records？这不否定问题，但能避免把一个大型 vendor dataset 说成全球普查。\n\n 这个 gap 长期存在，是因为 `p=reject` 不是简单改一行 DNS。它是一次 inventory project。\n\n 组织必须知道所有合法发信来源：Microsoft 365 或 Google Workspace、CRM、marketing automation、billing、helpdesk、HR tools、ticketing、旧服务器、扫描仪、外包发送服务，以及被遗忘的应用。每个邮件流都需要 SPF 或 DKIM alignment。Unknown senders 要么修复，要么迁到 subdomain，要么关闭。\n\n Reports 本身也是障碍。DMARC aggregate reports 现在由 RFC 9990 单独描述，是 machine-readable XML。对小团队来说，如果只是复制了一个 DNS example，却没有工具把 XML 变成可执行结论，报告就只是压缩文件堆。\n\n 担心误伤合法邮件并不荒唐。如果发票系统没有通过 DKIM alignment，`p=reject` 可能让发票丢失。如果客服平台通过错误路由用公司域名发信，enforcement 可能带来客户投诉。没有人想因为“提升安全”而弄坏 password resets。\n\n Microsoft 在 2026 年 1 月描述过 phishing 如何利用 complex routing 和 misconfigured spoof protections。这里的实际提醒是：routing、connectors、forwarding 和 gateways 都会影响接收方看到的 authentication 结果。\n\n 安全迁移应该分阶段。先做 domain inventory：primary sending domains、marketing subdomains、transactional subdomains、parked domains，以及永远不该发邮件的域名。对于 no-send domains，SPF `v=spf1 -all` 和 DMARC `p=reject; sp=reject` 通常能关闭一个简单滥用路径。\n\n 对于 active domains，`p=none` 只能是 temporary monitoring phase。设置有人真正查看的 reporting address，并用工具把 XML 转成决策。然后修复 alignment，尤其是第三方服务和 forwarded mail 中更常见的 DKIM 问题。\n\n 之后逐步推进：`p=none`，再到 `p=quarantine`，最后到 `p=reject`。每一步都看 helpdesk tickets、bounce logs、deliverability dashboards 和 DMARC reports。为每个 sender 记录 owner、platform、domain/subdomain、authentication method 和 rollback contact。\n\n DMARC 不会让 phishing 消失。但 enforcement 能去掉一种便宜招数：邮件看起来直接来自你的域名，authentication 却失败。`p=none` 适合作为学习阶段；如果长期停在那里，它就是只观察、不保护的控制措施。","available_translations":[{"language":"ar","title":"DMARC p=none مراقبة وليس حماية","html_url":"https://publicasta.com/cybersecurity/dmarc_p_none_enforcement_gap_email_spoofing_2026_07_30?lang=ar","markdown_url":"https://publicasta.com/cybersecurity/dmarc_p_none_enforcement_gap_email_spoofing_2026_07_30.md?lang=ar","json_url":"https://publicasta.com/cybersecurity/dmarc_p_none_enforcement_gap_email_spoofing_2026_07_30.json?lang=ar","api_url":"https://publicasta.com/api/public/v1/channels/cybersecurity/articles/dmarc_p_none_enforcement_gap_email_spoofing_2026_07_30?lang=ar"},{"language":"de","title":"DMARC p=none überwacht, schützt aber nicht","html_url":"https://publicasta.com/cybersecurity/dmarc_p_none_enforcement_gap_email_spoofing_2026_07_30?lang=de","markdown_url":"https://publicasta.com/cybersecurity/dmarc_p_none_enforcement_gap_email_spoofing_2026_07_30.md?lang=de","json_url":"https://publicasta.com/cybersecurity/dmarc_p_none_enforcement_gap_email_spoofing_2026_07_30.json?lang=de","api_url":"https://publicasta.com/api/public/v1/channels/cybersecurity/articles/dmarc_p_none_enforcement_gap_email_spoofing_2026_07_30?lang=de"},{"language":"en","title":"DMARC p=none is monitoring, not protection","html_url":"https://publicasta.com/cybersecurity/dmarc_p_none_enforcement_gap_email_spoofing_2026_07_30?lang=en","markdown_url":"https://publicasta.com/cybersecurity/dmarc_p_none_enforcement_gap_email_spoofing_2026_07_30.md?lang=en","json_url":"https://publicasta.com/cybersecurity/dmarc_p_none_enforcement_gap_email_spoofing_2026_07_30.json?lang=en","api_url":"https://publicasta.com/api/public/v1/channels/cybersecurity/articles/dmarc_p_none_enforcement_gap_email_spoofing_2026_07_30?lang=en"},{"language":"es","title":"DMARC p=none es monitoreo, no protección","html_url":"https://publicasta.com/cybersecurity/dmarc_p_none_enforcement_gap_email_spoofing_2026_07_30?lang=es","markdown_url":"https://publicasta.com/cybersecurity/dmarc_p_none_enforcement_gap_email_spoofing_2026_07_30.md?lang=es","json_url":"https://publicasta.com/cybersecurity/dmarc_p_none_enforcement_gap_email_spoofing_2026_07_30.json?lang=es","api_url":"https://publicasta.com/api/public/v1/channels/cybersecurity/articles/dmarc_p_none_enforcement_gap_email_spoofing_2026_07_30?lang=es"},{"language":"fr","title":"DMARC p=none surveille, mais ne protège pas","html_url":"https://publicasta.com/cybersecurity/dmarc_p_none_enforcement_gap_email_spoofing_2026_07_30?lang=fr","markdown_url":"https://publicasta.com/cybersecurity/dmarc_p_none_enforcement_gap_email_spoofing_2026_07_30.md?lang=fr","json_url":"https://publicasta.com/cybersecurity/dmarc_p_none_enforcement_gap_email_spoofing_2026_07_30.json?lang=fr","api_url":"https://publicasta.com/api/public/v1/channels/cybersecurity/articles/dmarc_p_none_enforcement_gap_email_spoofing_2026_07_30?lang=fr"},{"language":"pl","title":"DMARC p=none monitoruje, ale nie chroni","html_url":"https://publicasta.com/cybersecurity/dmarc_p_none_enforcement_gap_email_spoofing_2026_07_30?lang=pl","markdown_url":"https://publicasta.com/cybersecurity/dmarc_p_none_enforcement_gap_email_spoofing_2026_07_30.md?lang=pl","json_url":"https://publicasta.com/cybersecurity/dmarc_p_none_enforcement_gap_email_spoofing_2026_07_30.json?lang=pl","api_url":"https://publicasta.com/api/public/v1/channels/cybersecurity/articles/dmarc_p_none_enforcement_gap_email_spoofing_2026_07_30?lang=pl"},{"language":"ru","title":"DMARC p=none — это мониторинг, а не защита","html_url":"https://publicasta.com/cybersecurity/dmarc_p_none_enforcement_gap_email_spoofing_2026_07_30?lang=ru","markdown_url":"https://publicasta.com/cybersecurity/dmarc_p_none_enforcement_gap_email_spoofing_2026_07_30.md?lang=ru","json_url":"https://publicasta.com/cybersecurity/dmarc_p_none_enforcement_gap_email_spoofing_2026_07_30.json?lang=ru","api_url":"https://publicasta.com/api/public/v1/channels/cybersecurity/articles/dmarc_p_none_enforcement_gap_email_spoofing_2026_07_30?lang=ru"},{"language":"zh","title":"DMARC p=none 是监控，不是保护","html_url":"https://publicasta.com/cybersecurity/dmarc_p_none_enforcement_gap_email_spoofing_2026_07_30?lang=zh","markdown_url":"https://publicasta.com/cybersecurity/dmarc_p_none_enforcement_gap_email_spoofing_2026_07_30.md?lang=zh","json_url":"https://publicasta.com/cybersecurity/dmarc_p_none_enforcement_gap_email_spoofing_2026_07_30.json?lang=zh","api_url":"https://publicasta.com/api/public/v1/channels/cybersecurity/articles/dmarc_p_none_enforcement_gap_email_spoofing_2026_07_30?lang=zh"}],"_links":{"self":"https://publicasta.com/cybersecurity/dmarc_p_none_enforcement_gap_email_spoofing_2026_07_30.json?lang=zh","api":"https://publicasta.com/api/public/v1/channels/cybersecurity/articles/dmarc_p_none_enforcement_gap_email_spoofing_2026_07_30?lang=zh","html":"https://publicasta.com/cybersecurity/dmarc_p_none_enforcement_gap_email_spoofing_2026_07_30?lang=zh","canonical":"https://publicasta.com/cybersecurity/dmarc_p_none_enforcement_gap_email_spoofing_2026_07_30?lang=zh","markdown":"https://publicasta.com/cybersecurity/dmarc_p_none_enforcement_gap_email_spoofing_2026_07_30.md?lang=zh","json":"https://publicasta.com/cybersecurity/dmarc_p_none_enforcement_gap_email_spoofing_2026_07_30.json?lang=zh","channel":"https://publicasta.com/api/public/v1/channels/cybersecurity","channel_articles":"https://publicasta.com/api/public/v1/channels/cybersecurity/articles","search":"https://publicasta.com/api/public/v1/search","documentation":"https://publicasta.com/api-docs#reading-publicasta","openapi":"https://publicasta.com/api-docs/openapi.json","llms":"https://publicasta.com/llms.txt"}}