I take the opposite approach, I refuse to whitelist domains. When someone internal complains I send a notice to their contact on the other end (CCing the internal recipient) saying their email is misconfigured and ask them to put me in touch with their IT department to help them fix it. I use a script to do some DNS lookups and write the email for me. I have about a 50% success rate getting them to fix it.

My spirit was broken for that kind of work a long time ago.

More often than not I end up talking to someone in the sender's IT who fancies themself an expert and is completely incredulous that there could possibly be a problem on their side ("But we don't have problems sending email to anybody but you...")

I should want to fight the good fight, but it's so demoralizing.

Edit:

Dealing with other IT people on problems like this taught me a ton of humility. It wasn't until I was in my early 30s before I'd reached a level of maturity to approach trouble reports like this being reported to me with an open mind. Before that I fancied myself and expert and, likely, was insufferable in many contexts.

Now I'm insufferable in fewer contexts.

What happens in the other 50%? Your users work around you somehow?

Falls outside scope.

Only half joking. If you can't figure out SPF/DKIM then you should find a new job.

I have also done this, but instead by finding someone from IT or security on LinkedIn and messaging them there.

Good on you!

I don't get it. Neither one is hard to setup. How do people have such a hard time with such simple configuration. Then again the majority of "mail admins" I have interacted with have absolutely no understanding of SMTP and can barely wrap their heads around DNS.

I've had more than one argue with me that having more than 10 lookups in the SPF isn't the issue even though I am showing them the SPF failure and the RFC stating that you are not allowed more than 10. Like, good for you that Gmail doesn't care, we do, fix your shit.

DKIM is hard to set up. SPF is easy.

No it's not. You just publish another TXT record.

...... and sign all outgoing emails.

Which is not hard to do. It's literally a switch in O365. It takes a bit more in other environments, but nothing a competent admin should really struggle with.

so your opinion is that anyone who self-hosts their email is not competent? You know, there's a huge amount of machinery behind that toggle switch Microsoft offers you.

No. I think that people who can't figure out how to install openDKIM and connect it to Postfix are not competent email admins.

The real reason p=none persists is because people would rather err on the side of email being delivered that is actually junk than having a miss of legitimate mail. (This also the reason for so many soft failure entries in SPF records.)

This is true. Here’s a cautionary tale to that end. My org’s IT recently introduced, without input, an ai filtering tool to automatically filter junk email. It apparently worked too well. In an ironic twist of fate, it filtered a raft of emails (across multiple domains, including tickets and account reps!) to IT from an important vendor about contract renewal into junk that ultimately resulted in leaving the vendor no choice but to suspend service until the bill was paid (they waited until the very large bill was over two months past due to do this, to their credit).

When I learned about this during the post-mortem I was incensed, to say the least. Email mgmt is part of a professional’s job, for better or worse. Accountability for that doesn’t suddenly evaporate because of a scenario like this. I don’t practice zero inbox for fun. I do it for my sanity and effectiveness. Technology can’t magically solve every problem.

I don't mind p=none. I'm more bent out of shape about policies that tell me to reject that, if followed, would result in the loss of legit email.