Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Spammers are better at SPF, DKIM, and DMARC than everyone else

toad.social

Post reply on HN
Print view View original

51–60 of 261 posts

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#51

Post by SXX »

b112 wrote: post #13
citrin_ru wrote: post #6

Earlier quoted context omitted.

A better analogy would be a passport. It doesn’t stop all terrorists from boarding a plane at lest it stops already know to authorities ones (unless they have a passport on someone else’s name which is not easy).

Or perhaps, why do you lock the door to your house? A few solid kicks will open most doors, the locks can be picked, someone can smash windows and enter, and many modern homes can be entered by ripping the wall open with a crowbar and axe. It's to stop midrange threats.

Doors and locks are purely social construct. For majority of people it's much easier to justify stealing from a porch compared to breaking in.

No more, no less.

For spammers on other hand it's just a business, there will be no reprecussions like ever and we know quite a few big and legitemate companies who started their path with marketing spam sometimes using leaked email databases.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#52

Post by jeroenhd »

gus_massa wrote: post #48
jeroenhd wrote: post #16

Earlier quoted context omitted.

Yup, that'll get you stuck in spam limbo alright. Good luck climbing out if it if you're initiating conversations with anyone on Gmail or Outlook (or, even worse, corporate Outlook). Those email services will usually have no trouble with replies to emails sent from their service, so if you get someone to email you first you'll save them the trouble of dragging your email from their spam folder to their inbox.

With Outlook, in my university the problem was that when we send emails they disappeared mid air, no bounce, no spam folder. The solution was that they must write an email from the Outlook address, after that we are added to a secret good list and we can write them.

I've had to figure out a problem with reaching university Outlook servers where the Outlook server didn't like the (spec compliant) way my email server was writing the From address and rewrote it halfway through the spam filtering chain.

Then it checked the DKIM signature on the message it REWROTE ON ITS OWN and decided that the signature didn't match, and rejected my email.

Corporate email stacks are hell.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#54

Post by wizzwizz4 »

jeroenhd wrote: post #52
gus_massa wrote: post #48

Earlier quoted context omitted.

With Outlook, in my university the problem was that when we send emails they disappeared mid air, no bounce, no spam folder. The solution was that they must write an email from the Outlook address, after that we are added to a secret good list and we can write them.

I've had to figure out a problem with reaching university Outlook servers where the Outlook server didn't like the (spec compliant) way my email server was writing the From address and rewrote it halfway through the spam filtering chain. Then it checked the DKIM signature on the message it REWROTE ON ITS OWN and decided that the signature didn't match, and rejected my email. Corporate email stacks are hell.

Do you have a write-up of this, anywhere? I'd appreciate the details (what format did it reject? what did it change it to? what version of Exchange?).

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#55

Post by dig1 »

upofadown wrote: post #34

SPF/DKIM is really about mail server reputation. So it mostly benefits larger servers like the ones run by Google, Microsoft and Yahoo. Unfortunately, that means that attempts by those larger providers to combat spam using such reputation will naturally hurt smaller providers. So the actual effects of SPF/DKIM are on the whole negative. The root problem is that we don't actually need to keep track of email server rep…

> That implies that we have some work to do on the problem of identity. As it is, there is not even a way for a known email sender to securely introduce an unknown email sender.

There is: gpg/pgp signature, but many people find it complicated, primarily because they are reluctant to read the documentation. And it’s popular to criticize it, especially here on HN, in favor of various half-baked alternatives.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#57

Post by ghusto »

upofadown wrote: post #34

SPF/DKIM is really about mail server reputation. So it mostly benefits larger servers like the ones run by Google, Microsoft and Yahoo. Unfortunately, that means that attempts by those larger providers to combat spam using such reputation will naturally hurt smaller providers. So the actual effects of SPF/DKIM are on the whole negative. The root problem is that we don't actually need to keep track of email server rep…

> Unfortunately, that means that attempts by those larger providers to combat spam using such reputation will naturally hurt smaller providers

Tin-foil hat time, but I've always thought there was nothing unintentional or "unfortunate" (from Google's perspective) about this.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#58

Post by ghusto »

jasode wrote: post #42
upofadown wrote: post #34

SPF/DKIM is really about mail server reputation. So it mostly benefits larger servers like the ones run by Google, Microsoft and Yahoo. Unfortunately, that means that attempts by those larger providers to combat spam using such reputation will naturally hurt smaller providers. So the actual effects of SPF/DKIM are on the whole negative. The root problem is that we don't actually need to keep track of email server rep…

>SPF/DKIM is really about mail server reputation. So it mostly benefits larger servers like the ones run by Google, Microsoft and Yahoo. Unfortunately, that means that attempts by those larger providers to combat span using such reputation will naturally hurt smaller providers. So the actual effects of SPF/DKIM are on the whole negative. That paragraph is incorrect. SPF/DKIM is not about reputation. The main purpose…

And it will mysteriously _stop_ being able to send mail to Google despite you doing everything right, because of whatever nonsense they use to determine reputation.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#59

Post by jeroenhd »

csomar wrote: post #40
jeroenhd wrote: post #5

For me, as someone with their own mail server, these technologies mostly serve to inform me that Russian IP addresses are still trying to send email in the name of my domain for some stupid reason. It makes sense that people whose business is sending email know how to set up email correctly. I'm mostly surprised at how many legitimate sysadmins struggle with getting the basics correct. Surely those dozens of DMARC em…

> that Russian IP addresses are still trying to send email in the name of my domain for some stupid reason You can set your policy to reject, that will deter the Russians from using your domain.

I used to have my policy set to reject, but then I found out some part of an Enterprise Outlook mail filtering chain was rewriting the mail I sent before checking the DKIM signature. I can't fix stupid, especially for other parties, so I changed the policy to quarantine instead.

I doubt Russian spammers will care about the difference to be honest. If they accept that their email will be delivered to spam folders, why would they care that the email gets silently dropped? In neither case anyone is going to fall for them.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#60

Post by zzzeek »

I know very little about these protocols, except for having to deal with them a bit on those few sad occasions I need to get a server to send email. From those experiences I had a strong sense that Google pushes out all these complicated and difficult procedures on everyone just as a means of discouraging people from using email servers in the first place...."just use google, we control the whole thing anyway".
Post reply on HN