Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Learn and Test DMARC

learndmarc.com

Post reply on HN
Print view View original

51–60 of 65 posts

Re: Learn and Test DMARC

#51

Post by RektBoy »

Rookie42 wrote: post #31

Great way of pushing the critical email services we all need to reduce spam. While I have always wanted SPF, DKIM and DMARC to be enough of an incentive for the businesses i work with, reputation is often not enough of a driver to prioritise the investment. But fret not! For when you are dealing with companies which want to communicate with customers in a trusted way, there is a marketer's dream standard - Brand Indi…

What's keeping me, (as an attacker) from setting up phishing domain with same logo for BIMI?

Re: Learn and Test DMARC

#52

Post by freddieleeman »

RektBoy wrote: post #51
Rookie42 wrote: post #31

Great way of pushing the critical email services we all need to reduce spam. While I have always wanted SPF, DKIM and DMARC to be enough of an incentive for the businesses i work with, reputation is often not enough of a driver to prioritise the investment. But fret not! For when you are dealing with companies which want to communicate with customers in a trusted way, there is a marketer's dream standard - Brand Indi…

What's keeping me, (as an attacker) from setting up phishing domain with same logo for BIMI?

You will need Verified Mark Certificates (VMC's) issued by a Certificate Authority.

Re: Learn and Test DMARC

#53

Post by blacklion »

Does anybody know open-source or, at least, free way to process DMARC reports?

I have several e-mail domains with SPF, DKIM and DMARC enabled, and it works, but I have two annoying problems with DMARC:

(1) Some sites like to send DMARC reports which says "you send us 3 messages, everything is OK, all checks are passed, you are clear".

(2) Sometimes my domains are used to (try to) send spam via other servers and I got DMARC reports like "this tired to spam with your domain in HELO/FROM and we killed it, as checks failed".

Both reports are of no use for me: I don't want to know, that my users send mail to @gmail.com and @mail.ru (first reports) and I can do nothing about second case, as these s are not s of my server, so what should I do?

Some filter or dashboard will be very useful, as unpacking & checking XMLs by hands are very cumbersome.

Re: Learn and Test DMARC

#54

Post by rst »

jeroenhd wrote: post #40
Rookie42 wrote: post #31

Great way of pushing the critical email services we all need to reduce spam. While I have always wanted SPF, DKIM and DMARC to be enough of an incentive for the businesses i work with, reputation is often not enough of a driver to prioritise the investment. But fret not! For when you are dealing with companies which want to communicate with customers in a trusted way, there is a marketer's dream standard - Brand Indi…

DMARC still has some issues. From a few years ago: https://i.blackhat.com/USA-20/Thursday/us-20-Chen-You-Have-N... > Unfortunately, neither SPF nor DKIM provides a complete solution for preventing email spoofing. SPF authenticates the HELO/MAIL FROM identifier and DKIM authenticates the d= field in DKIM-signature header: neither of them authenticates the From header displayed to the end-user, which means that even if…

As a practical example -- it's pretty common for companies to delegate email to a provider like Gmail. Some infosec folks consider this best practice, and Google will allow you to configure DMARC to say that only messages originating from their servers are legit.

However, this does mean that anyone who can suborn Google's mail servers can use them to spend spoof emails that DMARC will rate as legitimate -- and last month, there was announcement of vulnerabilities (since fixed) which allowed a third party to abuse email-forwarding features to do exactly that. See https://arxiv.org/pdf/2302.07287.pdf

Re: Learn and Test DMARC

#55

Post by pch00 »

blacklion wrote: post #53

Does anybody know open-source or, at least, free way to process DMARC reports? I have several e-mail domains with SPF, DKIM and DMARC enabled, and it works, but I have two annoying problems with DMARC: (1) Some sites like to send DMARC reports which says "you send us 3 messages, everything is OK, all checks are passed, you are clear". (2) Sometimes my domains are used to (try to) send spam via other servers and I got…

dmarcian have a free "personal" tier: https://dmarcian.com/pricing/

Re: Learn and Test DMARC

#56

Post by JulianWasTaken »

blacklion wrote: post #53

Does anybody know open-source or, at least, free way to process DMARC reports? I have several e-mail domains with SPF, DKIM and DMARC enabled, and it works, but I have two annoying problems with DMARC: (1) Some sites like to send DMARC reports which says "you send us 3 messages, everything is OK, all checks are passed, you are clear". (2) Sometimes my domains are used to (try to) send spam via other servers and I got…

parsedmarc (https://github.com/domainaware/parsedmarc) is the one I've had starred to look at, but no first-hand use yet.

Re: Learn and Test DMARC

#57

Post by hannob »

blacklion wrote: post #53

Does anybody know open-source or, at least, free way to process DMARC reports? I have several e-mail domains with SPF, DKIM and DMARC enabled, and it works, but I have two annoying problems with DMARC: (1) Some sites like to send DMARC reports which says "you send us 3 messages, everything is OK, all checks are passed, you are clear". (2) Sometimes my domains are used to (try to) send spam via other servers and I got…

Here's a script I wrote for myself: https://github.com/hannob/rpter It gives a summary of reports, and details for failures. Not super sophisticated, but should be simple enough to extend. Also parses SMTP-TLS reporting.

Re: Learn and Test DMARC

#58

Post by karmelapple »

jeroenhd wrote: post #40
Rookie42 wrote: post #31

Great way of pushing the critical email services we all need to reduce spam. While I have always wanted SPF, DKIM and DMARC to be enough of an incentive for the businesses i work with, reputation is often not enough of a driver to prioritise the investment. But fret not! For when you are dealing with companies which want to communicate with customers in a trusted way, there is a marketer's dream standard - Brand Indi…

DMARC still has some issues. From a few years ago: https://i.blackhat.com/USA-20/Thursday/us-20-Chen-You-Have-N... > Unfortunately, neither SPF nor DKIM provides a complete solution for preventing email spoofing. SPF authenticates the HELO/MAIL FROM identifier and DKIM authenticates the d= field in DKIM-signature header: neither of them authenticates the From header displayed to the end-user, which means that even if…

We literally just ran into another issue with SPF: the SPF Lookup Limit [1] , which could cause receiver servers to bounce your email back with an "SPF PermError".

If your SPF record causes receiving mail servers to lookup too many domains, some receiving mail servers will reject your email, even when the email itself passes all SPF/DKIM/DMARC checks.

The tricky part of that to diagnose - which [1] talks about, and links to a tool to diagnose it [2] - is that there may be additional lookups that the servers you list in your SPF cause to happen.

So you could have an SPF record with only 4 servers, but if one of those servers causes 7 additional lookups, you might have over 10 SPF lookups. 10 seems to be a growing-in-popularity limit on SPF lookups.

So even if you have SPF, DKIM, and DMARC setup, make sure you don't have too many lookups caused by your SPF record!

1. https://easydmarc.com/blog/spf-too-many-dns-lookups-error 2. https://easydmarc.com/tools/spf-lookup

Re: Learn and Test DMARC

#59

Post by alt227 »

patmorgan23 wrote: post #16
graypegg wrote: post #2

This is so cool! I would love to see this for other protocols actually, maybe SSL or something!

https://www.ssllabs.com/ssltest/

SSLLabs is awesome, I use it regularly for work. So much information returned that it is like a school day reading through the results.

Re: Learn and Test DMARC

#60

Post by alt227 »

graypegg wrote: post #2

This is so cool! I would love to see this for other protocols actually, maybe SSL or something!

The UK Government provide a similar check which is a lot more user friendly.

I use it for sending reports to upper management, who just want to see big green ticks next to our domain names:

https://emailsecuritycheck.service.ncsc.gov.uk/check

Post reply on HN