Summary

  • Palisade’s August benchmark, highlighted by Internet Society Pulse on 1 September, found valid DMARC records on 58.1% of observed domains; 20.7% of those publishers listed no aggregate-report address.
  • The findings do not establish provider causation or customer negligence. They make a narrower question worth asking: who has actually agreed to maintain the domain policy after the mail service goes live?

The mailbox contract can be signed while another job remains unassigned. Somebody must know which systems legitimately send using the organisation’s domain, arrange their authentication, examine feedback and decide when the domain’s requested treatment should change. Buying email hosting may include these services. The supplier’s name alone does not establish that it does.

That distinction is the useful governance question raised by a 1 September guest article on Internet Society Pulse. Its author, Samuel Chenard, is Palisade’s CEO and co-founder. Internet Society expressly separates guest views from its own; this is a vendor’s published research, not an institutional mandate.

One snapshot, several denominators

The matching Palisade provider benchmark examined 99,300 domains in an eight-minute scan on 14 August. It reports 57,732 valid DMARC publishers, or 58.1% of the observed set. Of those publishers, 36,938—64%—requested quarantine or rejection of failing mail, while 11,959—20.7%—did not list an aggregate-reporting address.

These are published DNS observations, not independently reproduced results or an audit of service contracts. The sample comes from highly ranked web domains, not every organisation that uses email. Nor does an MX record necessarily identify the underlying mailbox platform: a gateway can sit in front of it. Palisade adjusts its provider comparisons for rank bands, but an observational comparison still cannot show that choosing a particular provider caused a policy outcome.

The numbers therefore cannot tell a purchaser which vendor to choose. They can prompt a better question about what has been purchased.

The work can move; it cannot be inferred away

RFC 9989, the current DMARC specification, connects the domain policy to aligned authentication, feedback and remediation of legitimate sending problems. Its definition of Domain Owner includes providers acting for clients. An organisation can delegate the work; the protocol is not imposing a non-delegable legal duty on its staff.

The practical scope nevertheless needs names and actions. A mail host may operate employee mail, a different service may send invoices, and another team may control DNS. Someone must reconcile those senders before an enforcement change affects legitimate messages. A managed service can be valuable precisely because it takes on that coordination explicitly.

A monitoring policy, p=none, is not automatically evidence of neglect. RFC 9989 recommends it as a starting point while legitimate senders are discovered and authentication gaps repaired. The relevant question is whether the observation phase has an owner and a reasoned next step, not whether a dashboard shows the strictest setting.

Likewise, the benchmark’s missing-report-address count is not proof that all those domains lack monitoring. Conversely, listing an address does not prove useful reports arrive or are read: RFC 9990 includes destination-authorisation and delivery conditions. DNS alone cannot reveal the organisation’s operating arrangement.

A service boundary worth making explicit

Lu Heng’s argument for a minimal shared specification and local decisions offers an editorial lens here. A common protocol makes different operators’ actions intelligible; it does not settle every local division of labour. This is an interpretation of the research, not an additional IETF requirement.

The constructive response is not to bring every mailbox back in-house. It is to state whether sender inventory, report review, DNS changes and approval of enforcement are included, retained or separately contracted. Outsourcing can simplify the operation. It works better when the continuing jobs travel with an agreed scope.

Sources