News
DMARC standards and mailbox provider requirements.
Event dates and source review dates are shown for each brief. Subscribe via RSS
-
Rspamd October updates fix security and authentication checks
Rspamd 4.2.3 fixes trust in ARC chains with invalid seals, following earlier October security updates. Gateway operators should review trust and scoring rules.
-
hMailServer October updates fix DKIM forgery and delivery flaws
Progressive Robot’s hMailServer 6.3.7 fixes signing of forged mail with hosted domains’ DKIM keys, following 6.3.6’s authentication and delivery fixes.
-
Cisco warns of exploited Secure Email Gateway attachment flaw
Cisco confirms exploitation of CVE-2026-76519. Gateway operators should verify scanner updates and check for compromise across their clusters.
-
PingOne asks administrators to prepare DKIM by 31 October
PingOne announces DKIM requirements for email trust and changes to notification customization. Administrators should prepare DNS before the stated date.
-
Stalwart 0.16.25 fixes DKIM key rotation failures
Stalwart fixes rotation bugs that could leave mail unsigned or activate unpublished DKIM keys. Operators should check DNS management and delivered signatures.
-
iCloud spoofing disclosure shows limits of domain authentication
SEC Consult discloses iCloud header-parsing flaws that passed SPF, DKIM and DMARC. Its timeline confirms remediation in December 2025.
-
Stalwart September updates fix DMARC results and reports
Stalwart’s September releases correct DMARC result labels and aggregate report XML. Operators should check logs and newly generated reports after upgrading.
-
UK census finds reporting records still naming retired Mail Check
A September study finds old Mail Check destinations in public-sector DMARC and TLS reporting records, prompting a review of replacement monitoring.
-
IETF mail transition changes address rewriting for DMARC
The IETF’s September mail transition rewrites addresses according to SPF and DMARC policies. Teams using its lists should check headers and replies.
-
DMARC moves onto the IETF Standards Track
Three new RFCs replace the original DMARC specification, separating the core protocol from reporting.
-
Outlook requires authentication from high-volume senders
Microsoft’s May 2025 change makes SPF, DKIM, and DMARC an operational requirement for affected senders.
-
Gmail’s bulk sender rules: the authentication baseline
A reference brief on the requirements introduced in 2024 for senders reaching personal Gmail accounts.