Gmail accepts forged YouTube emails

I have the _exact_ same problem, and I've never had it with any other mail provider. They say Gmail is 'the most advanced'. I may be wrong but I don't remember them being as bad going back, so I guess their advancements aren't working.

I mean, Paul Graham seems to be doing fine with a simple[1] algorithm. If I remember correctly, most mail providers used to do the same thing as he described.

"Good security means constantly staying ahead of threats, and our existing ML models are highly effective at doing this—in conjunction with our other protections, they help block more than 99.9 percent of spam, phishing, and malware from reaching Gmail inboxes" [2]

That may be true, if you don't consider false positives.

[1] http://www.paulgraham.com/antispam.html

[2] https://cloud.google.com/blog/products/g-suite/ridding-gmail...

Fun fact: sns.amazonaws.com has no DMARC record. Basically all alerts from AWS can be forged or end up in your spam folder and you have no way to know they really came from Amazon. You might say: oh, there's probably a good reason they don't have DMARC, right? Apparently the reason is it's a feature request that they haven't gotten to. And SNS has been around for 12 years.

If I'm a hacker trying to phish someone into giving me their AWS creds, I'm faking CloudWatch alerts that say RDS is down and linking to my malware site. Because real CloudWatch alerts already end up in your spam folder (because no DKIM), no way to know if it's real or not unless you closely examine every link before clicking.

DMARC is not a complete solution

Many email clients don't preserve message integrity when mail is forwarded, which breaks DKIM as well as SPF.

Mailing lists still alter message fields which break DKIM and they forward mail, which breaks SPF. Mailing list software is being brought up to date to deal with this, by adjusting the "From" header and re-signing the message with updated DKIM information.

Many users are still not evaluating their email with an educated, critical eye. All the automated checking in the world still can't stop a user clicking on a message sent from "PayPa1" .

SPF, DKIM, DMARC, and ARC at Fastmail: inbound mail Fastmail checks SPF, DKIM, DMARC, and ARC on all inbound mail. Passing or failing these checks only alters a message's spam score; we do not outright reject mail, only mark it as more or less suspicious. We add a standard Authentication Results header to all received mail explaining the results of the authentication checks.

SPF, DKIM, DMARC, and ARC at Fastmail: outbound mail We publish a relaxed SPF policy and DKIM-sign all outbound mail from our domains.

If you have a custom domain, you can set your SPF, DKIM and DMARC policy on your DNS screens. We have instructions if you host your DNS with us. If you use another DNS provider, you need to publish the correct records at your DNS provider.

Fastmail domains have a DMARC policy of none, which means recipient mail servers should report whether the message passes or not, but not change deliverability. This allows users to send mail using our domains from anywhere, for legacy reasons.

In the future we will publish a p=reject policy for our domains. This means to send with a From address at one of our domains, youʼll have to send through our servers.

Any mail which passes through our system on the way to another provider will be ARC sealed with the authentication results when the mail was received.

Longer blog post about this subject: https://fastmail.blog/advanced/spf-dkim-dmarc/

https://www.fastmail.help/hc/en-us/articles/1500000280461-Se...

It's not just you, and it's not just people who are self-hosting. The agressive spam filtering at Gmail/Hotmail is an industry-wide issue and while most of us get by, there's no denying that there's a lot of false positives.

The Mailop mailing list has a nice note about it on their Best Practices page:

> If you want to send mail to recipients who have accounts at big email providers, be aware that all of the above cannot guarantee that these providers won’t reject your mail, put it straight into recipient’s spam folder or just silently discard it - they just impose their own rules on anyone and you virtually can’t do anything about it.

DMARC is important if you want to create your own spam rules, such as "Send all e-mails from *.amazonaws.com that don't have valid DMARC to a Phishing folder".

Sure, an attacker could use no-reply@sns.amazonaws.com.attacker.domain. But most of our users have been trained to briefly look at the From: address before clicking things, so those would not succeed often. Without DMARC, we can't even catch phishes of the real domain.