@jwz@mastodon.social The stats we collect for the #SpamAssassin project (mass-scan results from participating sites) have long shown that spammers are more consistent at making SPF, DKIM, and DMARC correct than are legitimate senders. DMARC in particular has no discernible benefit for most senders, so it is a useless signal. Rejecting mail based solely on authentication failures of those deeply flawed authentication methods does more harm than good.