Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Best hosted alternative to Google Workspace for email?

news.ycombinator.com

Post reply on HN
Print view View original

231–240 of 266 posts

Re: Ask HN: Best hosted alternative to Google Workspace for email?

#231

Post by 15characterslon »

hda111 wrote: post #228
brightball wrote: post #183

Earlier quoted context omitted.

That’s a huge security issue! Geez. If anybody realizes you’re using that service they can immediately impersonate you.

The email standards explicitly allow everyone to impersonate anyone. That’s why you should use S/MIME and PGP.

That's not true. SPF and DKIM were explicitly made to prevent email forging by authenticating the server, and the server is responsible for authenticating the user.

Please name even a single major mail provider that allows to send emails with arbitrary "from" headers.

https://datatracker.ietf.org/doc/html/rfc7208 https://datatracker.ietf.org/doc/html/rfc7489

Re: Ask HN: Best hosted alternative to Google Workspace for email?

#232

Post by 15characterslon »

hda111 wrote: post #229
15characterslon wrote: post #208

Earlier quoted context omitted.

No, they don't do that check, that is the problem.

I don’t think they can implement such a check without breaking changes.

And that's why we shouldn't fix bugs anymore? https://xkcd.com/1172/

Fixing this would only affect users who send emails "from" other users email addresses, basically users who commit fraud.

Re: Ask HN: Best hosted alternative to Google Workspace for email?

#233

Post by brewmarche »

15characterslon wrote: post #206
brewmarche wrote: post #101

Earlier quoted context omitted.

Oh wow, do you perhaps have more details on the current situation? The CEO’s response is from 4 years ago. I also don’t fully understand the reasoning. Having an open SMTP server that doesn’t restrict senders is one thing, but attaching DKIM without further checks is another.

AFAIK they still refuse to acknowledge the problem. But since they deleted the forum thread, how would I know. What they said in the forum doesn't make much sense. Yes, anyone in the wold can send emails with any address as "from". The big difference is that those emails won't pass SPF and DMARC checks. If I wanted to use them, I would need to configure SPF and DMARC for my domain so that their mail servers pass thos…

I assume you mean DKIM where you wrote DMARC. A DMARC check results in a pass when at least one of SPF or DKIM is aligned, i.e. SPF alignment alone is enough. Which makes this situation even worse because a custom domain user of mailbox.org obviously will have mailbox.org’s SMTP server in the SPF record.

It seems this issue was acknowledged 2 years ago: https://userforum-en.mailbox.org/topic/anti-spoofing-for-cus...

Edit: re the shared keys you mentioned I agree. If they had per-user DKIM keys that were only usable after successful SMTP authentication (e.g. by encrypting them with credentials) that would solve the DKIM part of the issue AND even further improve the situation.

Re: Ask HN: Best hosted alternative to Google Workspace for email?

#234

Post by upofadown »

15characterslon wrote: post #207
upofadown wrote: post #118

Earlier quoted context omitted.

Anyone willing to spin up a mail server can do this. DKIM and SPF are only intended to establish the identity of the server. I don't know that there is any obligation on the part of someone running a mail server to police the "From:" address on an email in some specific way. Traditionally the "From:" address was considered informational. It generally represents the address that the sender considers "their" email addr…

As others said, DKIM always includes "from". And almost none of the emails I get are S/MIME or PGP signed. Like you said: SPF and DMARC only authenticate the server. It's up to the server to authenticate the user. Scenario: imagine your bank uses Mailbox.org to send emails. How would you verify that an email is legit? Any Mailbox user can send emails through Mailbox with your bank as "from" and all of these emails pa…

Anyone that runs a mail server can generate emails with any "From:" address they want with a valid DKIM. The SPF works on the envelope address, not the "From:" address.

The actual complaint here is that mailbox.org is not policing the "From:" address and thus are providing such an ability to people that have not bothered to spin up a mail server on a domain they control.

Yeah, banks should sign their emails. I think that even Facebook does this if you give them a public key.

Re: Ask HN: Best hosted alternative to Google Workspace for email?

#235

Post by upofadown »

brightball wrote: post #184
upofadown wrote: post #118

Earlier quoted context omitted.

Anyone willing to spin up a mail server can do this. DKIM and SPF are only intended to establish the identity of the server. I don't know that there is any obligation on the part of someone running a mail server to police the "From:" address on an email in some specific way. Traditionally the "From:" address was considered informational. It generally represents the address that the sender considers "their" email addr…

If you’re using DMARC the from and the DKIM signature must be aligned or it doesn’t pass. Simply passing any DKIM check isn’t enough.

Mailbox.org has a DMARC policy of "reject". So receivers that enforced DMARC and did "domain alignment" would reject the email. Does that make what mailbox.org does with the "From:" address OK?

Re: Ask HN: Best hosted alternative to Google Workspace for email?

#236

Post by brewmarche »

upofadown wrote: post #234
15characterslon wrote: post #207

Earlier quoted context omitted.

As others said, DKIM always includes "from". And almost none of the emails I get are S/MIME or PGP signed. Like you said: SPF and DMARC only authenticate the server. It's up to the server to authenticate the user. Scenario: imagine your bank uses Mailbox.org to send emails. How would you verify that an email is legit? Any Mailbox user can send emails through Mailbox with your bank as "from" and all of these emails pa…

Anyone that runs a mail server can generate emails with any "From:" address they want with a valid DKIM. The SPF works on the envelope address, not the "From:" address. The actual complaint here is that mailbox.org is not policing the "From:" address and thus are providing such an ability to people that have not bothered to spin up a mail server on a domain they control. Yeah, banks should sign their emails. I think…

I’m sorry I don’t get the part about DKIM. I thought the DKIM signature would only be valid if the signing SMTP server has access to the private key matching the Header-From’s domain’s designated DKIM public key.

E: by valid I meant valid and aligned (according to DMARC), sorry

Re: Ask HN: Best hosted alternative to Google Workspace for email?

#237

Post by brightball »

upofadown wrote: post #235
brightball wrote: post #184

Earlier quoted context omitted.

If you’re using DMARC the from and the DKIM signature must be aligned or it doesn’t pass. Simply passing any DKIM check isn’t enough.

Mailbox.org has a DMARC policy of "reject". So receivers that enforced DMARC and did "domain alignment" would reject the email. Does that make what mailbox.org does with the "From:" address OK?

Not if they are still signing it with the private key for the domain.

If an email is sent with a From of @bob.com and DKIM signed using the private key for bob.com…it’s from bob.com.

Re: Ask HN: Best hosted alternative to Google Workspace for email?

#238

Post by upofadown »

brewmarche wrote: post #236
upofadown wrote: post #234

Earlier quoted context omitted.

Anyone that runs a mail server can generate emails with any "From:" address they want with a valid DKIM. The SPF works on the envelope address, not the "From:" address. The actual complaint here is that mailbox.org is not policing the "From:" address and thus are providing such an ability to people that have not bothered to spin up a mail server on a domain they control. Yeah, banks should sign their emails. I think…

I’m sorry I don’t get the part about DKIM. I thought the DKIM signature would only be valid if the signing SMTP server has access to the private key matching the Header-From’s domain’s designated DKIM public key. E: by valid I meant valid and aligned (according to DMARC), sorry

A sender can throw anything they want in the "From:" field and then sign it. The receiver does not have to agree. What would happen is that the receiver would see that the holder of the domain was different than the domain in the "From:" address and on the basis of bad "domain alignment" could reject the email.

I now think that the DMARC stuff is a red herring and would actually help make the current mailbox.org behaviour not all that problematic (they specify "reject" in their DMARC policy). The actual point of dispute is the lack of enforcement of the "From:" address domain.

Re: Ask HN: Best hosted alternative to Google Workspace for email?

#239

Post by matheweis »

mdasen wrote: post #38
Pasorrijer wrote: post #34

Earlier quoted context omitted.

Not true. You can host through any provider and link it to Office365.

https://support.microsoft.com/en-us/office/get-a-personalize... Q: I already own a domain that's registered with a provider other than GoDaddy. Can I set up a personalized email address in Outlook.com? A: At the moment, we only support connecting domains managed by GoDaddy with Outlook.com. Maybe that only applies to "Microsoft 365 Family or Microsoft 365 Personal" and not their business offering? They have a basic b…

The non-GoDaddy workaround from the adjacent reddit link works fine, not sure why the sibling comments have been downvoted so hard.

The reply to that about the workarounds disabling spf is wrong, at least for the adjacent reddit link. It includes relevant spf records and they appear to work fine.

I’ve been hosting my custom domain on the personal office 365 / outlook.com using these workarounds for a couple of weeks now and so far it has been working just fine.

Ideally dmarc and dkim would be supported, but it’s worth noting that it appear that neither of those are supported by the personal office 365 / outlook.com plan even with GoDaddy.

Post reply on HN