Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SPF, DMARC, and DKIM: How to Keep Your Email Out of the Spam Folder

wpsitecare.com

Post reply on HN
Print view View original

21–30 of 63 posts

Re: SPF, DMARC, and DKIM: How to Keep Your Email Out of the Spam Folder

#21

Post by panic »

walrus01 wrote: post #14
djsumdog wrote: post #7

I wrote this a while ago. I have SPF, DMARC and DKIM all implemented on my mail domain and I still get put in the spam folder: http://penguindreams.org/blog/how-google-and-microsoft-made-... I think part of it might be that I use Linode, and there are other spammers in their data centre, so I could just be on a subnet bad list. But I think a lot of it has to do with Google/Microsoft's spam filters just being crazy ov…

A huge part of the problem is that while your personal smtpd might be set up impeccably, you're in the same /24 as a bunch of other low cost bulk hosting customers that have in the past several years set up VPS with much less clue than you. As a result the entire ARIN netblock that your server resides in has a "poor" IP space reputation as seen by the opaque incoming anti-spam measures put in place by Microsoft and G…

And this is how the decentralized internet dies...

Re: SPF, DMARC, and DKIM: How to Keep Your Email Out of the Spam Folder

#24

Post by cm3 »

Say I want a personal domain and have the MX not be Google or Fastmail, how complete is the implementation of these standards on major email providers' SMTP setups? Would I need to do thorough research or is it reasonable to expect it to just work in a, say, European SMTP hoster's configuration?

Re: SPF, DMARC, and DKIM: How to Keep Your Email Out of the Spam Folder

#25

Post by medmunds »

edutechnion wrote: post #10

A few tips from setting up SPF/DMARC/DKIM for a SAAS service: * SPF: limit your record and all includes to 10 DNS lookups (e.g., "A MX include:_spf.google.com" is 3 DNS lookups plus all of the lookups inside the include. * DMARC: to see a strict reject policy, check out Yahoo: $ dig +short -t txt _dmarc.yahoo.com "v=DMARC1\; p=reject\; pct=100\; rua=mailto:dmarc_y_rua@yahoo.com\;" * Mail forwarding: if your app sends…

PostMark also has a helpful (and free) service that parses and summarizes the DMARC reports: https://dmarc.postmarkapp.com/. (And you don't have to be using PostMark to use this service.)

Re: SPF, DMARC, and DKIM: How to Keep Your Email Out of the Spam Folder

#26

Post by aroch »

walrus01 wrote: post #14
djsumdog wrote: post #7

I wrote this a while ago. I have SPF, DMARC and DKIM all implemented on my mail domain and I still get put in the spam folder: http://penguindreams.org/blog/how-google-and-microsoft-made-... I think part of it might be that I use Linode, and there are other spammers in their data centre, so I could just be on a subnet bad list. But I think a lot of it has to do with Google/Microsoft's spam filters just being crazy ov…

A huge part of the problem is that while your personal smtpd might be set up impeccably, you're in the same /24 as a bunch of other low cost bulk hosting customers that have in the past several years set up VPS with much less clue than you. As a result the entire ARIN netblock that your server resides in has a "poor" IP space reputation as seen by the opaque incoming anti-spam measures put in place by Microsoft and G…

>There's a pretty direct inverse correlation between the cost of a hosting service ($5/mo VPS vs. minimum $200/mo colocation of a 1U server) and how much outgoing abuse traffic has been sent from the particular netblock assigned to the enduser customers. Cheap hosting company = poor IP space reputation.

Eh...this is pretty much bullshit. Unless you're running your own, good-reputation AS (or happen to know someone running a clean AS who can either lend you an IP or announce a clean block for you), the /25|/29 assigned to you by your colo provider has just as good a chance as being dirty as that VPS providers.

Your colo provider is also more than likely happily delegating blocks to one of those cheap VPS providers out of the same larger netblock your IP. Chances are even good that you'll be given a /26 or a /29 that used to be used by one of the VPS providers.

If you see a provider offering "up to 256 clean IPs!!!", those aren't clean IPs. Those are, at best, greylisted IPs bought on the cheap and at worst /22's rented from poor rep /16's and rebadged in the hope no one will notice

Re: SPF, DMARC, and DKIM: How to Keep Your Email Out of the Spam Folder

#27

Post by walrus01 »

panic wrote: post #21
walrus01 wrote: post #14

Earlier quoted context omitted.

A huge part of the problem is that while your personal smtpd might be set up impeccably, you're in the same /24 as a bunch of other low cost bulk hosting customers that have in the past several years set up VPS with much less clue than you. As a result the entire ARIN netblock that your server resides in has a "poor" IP space reputation as seen by the opaque incoming anti-spam measures put in place by Microsoft and G…

And this is how the decentralized internet dies...

Yes, sort of, but not really a new problem. Low budget hosting companies have had poor IP space reputations and outgoing spam problems since such a thing as a hosting company began to exist, 20 years ago, way before there was such a thing as an x86-64 bare metal hypervisor or a VPS. The lower the cost the less clueful the customers. The problem is more on the google and MS side.

Re: SPF, DMARC, and DKIM: How to Keep Your Email Out of the Spam Folder

#28

Post by medmunds »

slasaus wrote: post #3

I think it's pretty weak they're advertising the use of "~all" in their spf records. Either use "-all" or just don't use SPF I would say. If you can't make a decisive statement about your own domain then it won't be actionable for receivers that evaluate your records.

If you use DMARC with a reject or quarantine policy, SPF hardfail ("-all") can prevent recipients from successfully forwarding mail you've sent them.

Some best practices for DKIM, SPF, and DMARC (as of mid-2015) in [1], including this:

> ...when an organization publishes p=reject [in DMARC], they should simultaneously change their SPF hard fail to SPF soft fail. ... A message that passes SPF and is forwarded will fail SPF. If a message hard fails SPF it will probably be marked as spam but if it soft fails, it will most likely still be accepted by the recipient. This forwarding failure possibility is why most organizations publish a soft fail record.

[1]: https://blogs.msdn.microsoft.com/tzink/2015/07/12/what-is-th...

Re: SPF, DMARC, and DKIM: How to Keep Your Email Out of the Spam Folder

#29

Post by walrus01 »

aroch wrote: post #26
walrus01 wrote: post #14

Earlier quoted context omitted.

A huge part of the problem is that while your personal smtpd might be set up impeccably, you're in the same /24 as a bunch of other low cost bulk hosting customers that have in the past several years set up VPS with much less clue than you. As a result the entire ARIN netblock that your server resides in has a "poor" IP space reputation as seen by the opaque incoming anti-spam measures put in place by Microsoft and G…

>There's a pretty direct inverse correlation between the cost of a hosting service ($5/mo VPS vs. minimum $200/mo colocation of a 1U server) and how much outgoing abuse traffic has been sent from the particular netblock assigned to the enduser customers. Cheap hosting company = poor IP space reputation. Eh...this is pretty much bullshit. Unless you're running your own, good-reputation AS (or happen to know someone ru…

Not really bullshit if you find the right hosting company. There's shitty $200/mo single server colo options, and less shitty ones. In my experience it comes down to personally knowing the people who run the ISP and how serious they are about network abuse issues (and general network engineering best practices). If you find a colo/cabinet space hosting company in a major city that's one of the founding members of a major IX there's somewhat more chance that they'll have network engineering staff who take such issues seriously.

On the customer side, one of the major bars to entry for clueless/spamming customers is whether it's possible to directly purchase hosting services online with a credit card and have them immediately provisioned and available. If you can get a VPS in 5 minutes by paypal it's easy to be clueless. If you need to set up and ship a server with its rails to a colo it's likely but not guaranteed that you have more clue than usual.

Yes, it's likely you might get an IP in a /26 that's part of a hosting company's much larger /22 or /20 which also contains shitty VPS. The key part there is to find a hosting company/ISP that doesn't do low budget hosting and never has.

Re: SPF, DMARC, and DKIM: How to Keep Your Email Out of the Spam Folder

#30

Post by medmunds »

edutechnion wrote: post #10

A few tips from setting up SPF/DMARC/DKIM for a SAAS service: * SPF: limit your record and all includes to 10 DNS lookups (e.g., "A MX include:_spf.google.com" is 3 DNS lookups plus all of the lookups inside the include. * DMARC: to see a strict reject policy, check out Yahoo: $ dig +short -t txt _dmarc.yahoo.com "v=DMARC1\; p=reject\; pct=100\; rua=mailto:dmarc_y_rua@yahoo.com\;" * Mail forwarding: if your app sends…

Implemented all of these on a bunch of my domains a few weeks ago. Two cautions related to whether your email can be forwarded by your recipients:

1. SPF -all can break forwarding with DMARC p=reject. If your recipients tend to forward your email, you probably want to stick with SPF ~all (or DMARC p=none) until standards settle (and get widely implemented) around rewriting headers during forwarding. [1]

2. Hotmail and Outlook.com recently introduced a change that breaks forwarding from any DMARC p=reject or p=quarantine sender, through a hotmail.com or outlook.com address, to any recipient MTA that enforces DMARC. There's not really anything you can do about this (as a sender) other than not use DMARC, so hopefully that gets fixed soon. [2]

[1]: https://blogs.msdn.microsoft.com/tzink/2015/07/12/what-is-th...

[2]: https://blogs.msdn.microsoft.com/tzink/2016/05/19/why-does-m...

Post reply on HN