Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Learn and Test DMARC

learndmarc.com

Post reply on HN
Print view View original

31–40 of 65 posts

Re: Learn and Test DMARC

#31

Post by Rookie42 »

Great way of pushing the critical email services we all need to reduce spam. While I have always wanted SPF, DKIM and DMARC to be enough of an incentive for the businesses i work with, reputation is often not enough of a driver to prioritise the investment.

But fret not! For when you are dealing with companies which want to communicate with customers in a trusted way, there is a marketer's dream standard - Brand Indicators for Message Identification (BIMI) - now security isnt the only outcome, you get a pretty logo too! https://www.litmus.com/blog/what-is-bimi-and-why-should-emai...

I have used BIMI at multiple companies now which talk about Customer Experience to drive the proper (P=Reject) implementation of DMARC.

Re: Learn and Test DMARC

#32

Post by ttul »

pests wrote: post #10
pests wrote: post #6

Very cool. > For DMARC to pass, DKIM and/or SPF checks need to pass and the domains must be in alignment. AFAIK this is incorrect. It is not "and/or" but rather "or" - only DKIM or SPF needs to pass. There is no method to require both.

This was a recent problem with Cloudflares partnership with MailChannels[1] that allowed email spoofing which was related to this. The basic problem being that mailchannel did not require authentication - cloudflare workers could just hit an API endpoint on mailchannel to send email. Mailchannel required you to add an include: record to your SPF policy. This allowed anyone to impersonate anyone else due to mailchanne…

Appreciate the skepticism; it keeps us on our toes. Let's cut to the chase:

Domain Lockdown: We added this to our Cloudflare Workers integration. It mandates a DNS TXT record to authorize a Worker to send emails from a specific domain. You can't forge the CF-Worker header, so impersonation is off the table.

Pre-Lockdown Vulnerability: Yes, we were more exposed before. Thanks to the researchers who pointed it out, we've patched this up with Domain Lockdown.

SMTP Relay & Web Hosting: Domain Lockdown isn’t mandatory yet in the rest of our service for the web hosting industry. But we’re developing updates for our cPanel WHM plugin and other integrations to make this scalable for millions of domains. Note that our service has to work for applications like public mailing lists where locking the sender domain down breaks stuff.

Scale & Standardization: We service a broad range of configurations. Rolling out universal changes takes time. We're also working with industry groups like M3AAWG to push for improvements to DMARC and other standards to help everyone be more secure.

Tech docs for the curious: https://support.mailchannels.com/hc/en-us/articles/456589835...

Appreciate all the questions and criticism here. reply

Re: Learn and Test DMARC

#33

Post by pests »

ttul wrote: post #32
pests wrote: post #10

Earlier quoted context omitted.

This was a recent problem with Cloudflares partnership with MailChannels[1] that allowed email spoofing which was related to this. The basic problem being that mailchannel did not require authentication - cloudflare workers could just hit an API endpoint on mailchannel to send email. Mailchannel required you to add an include: record to your SPF policy. This allowed anyone to impersonate anyone else due to mailchanne…

Appreciate the skepticism; it keeps us on our toes. Let's cut to the chase: Domain Lockdown: We added this to our Cloudflare Workers integration. It mandates a DNS TXT record to authorize a Worker to send emails from a specific domain. You can't forge the CF-Worker header, so impersonation is off the table. Pre-Lockdown Vulnerability: Yes, we were more exposed before. Thanks to the researchers who pointed it out, we'…

Thank you for the transparency and the update.

I didn't mean anything negative towards MailChannels - I know this is a weak link in the chain for many people. I did know it was resolved and I should have mentioned that but I couldn't figure out the search query to find that post.

Re: Learn and Test DMARC

#36

Post by bawolff »

pests wrote: post #24
bawolff wrote: post #20

Earlier quoted context omitted.

I think you are just misparsing their grammer. I believe and/or just means inclusive or. It does not mean "and" is neccesarily an option.

I think its unambiguous. If they want "and/or" to just mean inclusive or why not just use "or". Its shorter, simpler, easier to understand. I also feel "and/or" in general usually means either option are possible/acceptable. The point I was making is that "DMARC passes if DKIM _and_ SPF passes" and "DMARC passes if DKIM _or_ SPF passes" are both true - you can't specify "DMARC passes if, and only if, DKIM _and_ SPF p…

> If they want "and/or" to just mean inclusive or why not just use "or". Its shorter, simpler, easier to understand.

The english language being ambigious or not making sense is not a new issue. All i know, is i almost always see "and/or" used to mean inclusive or.

Also the dictionary seems to agree it means inclusive or: https://en.m.wiktionary.org/wiki/and/or

Re: Learn and Test DMARC

#37

Post by aeturnum »

I really appreciate the iterative way it goes through the process. It's been a few years but this would have been a godsend at a previous company when we were trying to move to self-hosted email sending with all the proper security measures.

Re: Learn and Test DMARC

#38

Post by pests »

bawolff wrote: post #36
pests wrote: post #24

Earlier quoted context omitted.

I think its unambiguous. If they want "and/or" to just mean inclusive or why not just use "or". Its shorter, simpler, easier to understand. I also feel "and/or" in general usually means either option are possible/acceptable. The point I was making is that "DMARC passes if DKIM _and_ SPF passes" and "DMARC passes if DKIM _or_ SPF passes" are both true - you can't specify "DMARC passes if, and only if, DKIM _and_ SPF p…

> If they want "and/or" to just mean inclusive or why not just use "or". Its shorter, simpler, easier to understand. The english language being ambigious or not making sense is not a new issue. All i know, is i almost always see "and/or" used to mean inclusive or. Also the dictionary seems to agree it means inclusive or: https://en.m.wiktionary.org/wiki/and/or

I agree the statement "DMARC passes if SPF (inclusive or) DKIM passes"

I was only trying to point out that "and/or" is ambiguous (which we agree, and Wikipedia even agrees - 2 paragraphs for a defintion, 5 paragraphs of criticism) and one of those ambiguities is thinking it means logical AND - which is something DMARC does not do.

Using just "or" would have been fine and conveyed the same meaning as it does now.

Re: Learn and Test DMARC

#40

Post by jeroenhd »

Rookie42 wrote: post #31

Great way of pushing the critical email services we all need to reduce spam. While I have always wanted SPF, DKIM and DMARC to be enough of an incentive for the businesses i work with, reputation is often not enough of a driver to prioritise the investment. But fret not! For when you are dealing with companies which want to communicate with customers in a trusted way, there is a marketer's dream standard - Brand Indi…

DMARC still has some issues. From a few years ago: https://i.blackhat.com/USA-20/Thursday/us-20-Chen-You-Have-N...

> Unfortunately, neither SPF nor DKIM provides a complete solution for preventing email spoofing. SPF authenticates the HELO/MAIL FROM identifier and DKIM authenticates the d= field in DKIM-signature header: neither of them authenticates the From header displayed to the end-user, which means that even if an email passes SPF and DKIM validation, its From address can still be forged.

A lack of DMARC+ on an email domain is definitely a problem, but DMARC+ alone still doesn't solve the "is this the real sender" problem.

Post reply on HN