Either the spammers haven't figured it out yet, or they realize it's a waste of time since all the messages are either mechanically processed or ignored.
Does this make having email accounts like this viable anymore? Am I at risk of my emails not getting where I expect them too, particularly important if I am looking for a new job?
I use Amazon WorkMail so will need to see if that has done what is necessary, but still worried what exactly this will mean.
Edit: Is there a tool to validate that things are setup how we need it to be?
But as far as the policy, it doesn't have to be enforced. For most people, this just means that they'll need to a quick DNS entry to their domain for an unenforced policy.
Example...
TXT _dmarc.example.com "v=DMARC1; p=none;"
I did a 3 part DMARC writeup a while back if you're curious to learn more. It's not hard to setup. In fact, the smaller you are, the easier it is.
There are plenty, but mxtoolbox.com is your friend for most things email related.
I'm not a fan of DMARC. SPF and DKIM already do their job well enough. Then people add DMARC with "p=none" just to tick their "have DMARC" box. Even google suggests a policy of "none" is ok, but doesn't mention that this means SPF and DKIM will be ignored.
See https://www.nslookup.io/learning/dmarc-a-practical-guide/
and this quote is not correct:
> Note that an email doesn't need to pass both DKIM and SPF. Just one is enough to validate an email.
Unless it was said in regards to DMARC, it usually depends on the mailfilter of the receiver. If it was said in regards to DMARC then it's just another point why DMARC is bad.
That is a logical next step down the road though and IMO long overdue.