Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Spammers are better at SPF, DKIM, and DMARC than everyone else

toad.social

Post reply on HN
Print view View original

181–190 of 261 posts

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#181

Post by WarOnPrivacy »

JohnMakin wrote: post #130
chillfox wrote: post #22

Earlier quoted context omitted.

In most organizations there is no point in a sysadmin to spend the effort in understanding how to set it up correctly as Marketing has got more authority on email. Marketing will simply demand changes to the config that they do not understand and there is nothing you can do to stop it as they will have the CEO on their side.

even worse when you have even less control than that, if you run some type of hosting and are trying to convince non-technical clients (or even worse, non technical clients who think they are technical) to “please just add this record exactly as it says here to your domain” and they’re somehow unable to for months and months

> "please just add this record exactly as it says here to your domain" and they’re somehow unable to for months and months

I ran into this helping a friend whose biz emails to gmail recipients were getting dropped; the IT dept of the umbrella corp wouldn't respond. Same to me when I sent the correct DMARC, SPF etc.

(My friend's biz was his own but it shared some resources with a larger corp.)

I eventually realized that the (wrong) DMARC reporting domain wasn't even registered. I did what you'd expect and I soon had DMARC reports for subsidiaries of the umbrella corp. My friend passed that up to the CEO and suddenly IT was responsive.

In the end, it turned out that IT was deliberately blocking his biz emails to his biz family members. After 10 years they suddenly decided that email to family+gmail was risky and that they were going to gaslight my friend about it. Because reasons.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#182

Post by miohtama »

zelon88 wrote: post #111
jeroenhd wrote: post #5

For me, as someone with their own mail server, these technologies mostly serve to inform me that Russian IP addresses are still trying to send email in the name of my domain for some stupid reason. It makes sense that people whose business is sending email know how to set up email correctly. I'm mostly surprised at how many legitimate sysadmins struggle with getting the basics correct. Surely those dozens of DMARC em…

The problems I noticed were, it doesn't matter what the SPF and DKIM look like. If Google or Microsoft refuse to relay your email based on secret internal factors then you're out of business.

Best, and often practically only, way to avoid this problem is to buy your email services from Google Microsoft duopoly.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#183

Post by kbolino »

Avamander wrote: post #154
kbolino wrote: post #101

Earlier quoted context omitted.

I'd also like to see an update to DMARC so you can require both SPF and DKIM in your policy, instead of just one out of the two.

Terrible idea, SPF is very hostile to (legitimate) forwarding. In general SPF should actually die.

If you have trusted forwarders, you just add them to the SPF policy (which can be recursive, though there is a pretty low limit on how many records can be looked up). I've not had an issue with this, personally. However, assuming DKIM can be tightened up as proposed above, I'm not sure SPF would be necessary anymore.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#184

Post by catlikesshrimp »

miohtama wrote: post #182
zelon88 wrote: post #111

Earlier quoted context omitted.

The problems I noticed were, it doesn't matter what the SPF and DKIM look like. If Google or Microsoft refuse to relay your email based on secret internal factors then you're out of business.

Best, and often practically only, way to avoid this problem is to buy your email services from Google Microsoft duopoly.

Workaround (?) Buy their services for 1 (one) year and then move to something good (?)

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#185

Post by GnarfGnarf »

Yeah, SPF, DKIM and DMARC are incomprehensible. The only people with the time, motivation and expertise to understand and apply them, are professional spammers. Most of the legitimate email I get, fail one or more of these tests.

If I recall, SPF limits the number of domains you can enumerate in your DNS records.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#186

Post by alexjplant »

I used to run my own e-mail server for my personal address. In an attempt to reduce spam I configured Postfix to reject all inbound messages that weren't DKIM signed. The only time I ever had an issue was when somebody from the multinational publicly-traded company that I worked for tried to send a message to my personal inbox. They ran Exchange in the datacenter at the time (this would have been ~2017) and hadn't enabled DKIM signing. I had a friendly conversation with the sysadmin responsible for it and they had it enabled by the end of the week.

I suppose the moral of the story is that it's possible to do billions of dollars in business a year without having textbook-perfect mail infrastructure. Hell, I ran a mail server with bad MX records, a missing PTR record, and a mismatched HELO header and the world kept spinning (when I was a literal child with nobody to tell me better - I've since learned the error of my ways).

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#188

Post by andrew-jack »

toenail wrote: post #146
Jzush wrote: post #138

My biggest problem with SPF, DKIM, DMARC is when you go to test this crap there's really only commercial apps. So people who are setting up things for a non-profit or a personal project are either forced to pay after doing 3 or 4 test emails or you wait like 24 hours or some crap. And all that just for the privilege of being able to send email to some gmail accounts. Trying to get email to properly encrypt is pulling…

I use https://www.mail-tester.com/

[dead]

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#190

Post by JohnMakin »

WarOnPrivacy wrote: post #181
JohnMakin wrote: post #130

Earlier quoted context omitted.

even worse when you have even less control than that, if you run some type of hosting and are trying to convince non-technical clients (or even worse, non technical clients who think they are technical) to “please just add this record exactly as it says here to your domain” and they’re somehow unable to for months and months

> "please just add this record exactly as it says here to your domain" and they’re somehow unable to for months and months I ran into this helping a friend whose biz emails to gmail recipients were getting dropped; the IT dept of the umbrella corp wouldn't respond. Same to me when I sent the correct DMARC, SPF etc. (My friend's biz was his own but it shared some resources with a larger corp.) I eventually realized th…

That’s a wild story, thanks for sharing - I find interfacing with external IT teams extraordinarily frustrating. I suspect it’s because businesses often don’t manage their IT teams well or have a good process to expedite business -> IT requests that really should be super easy and provide a lot of tangible value for the amount of comparative effort involved.

I’ve run into outright malicious stuff internally like this, but never externally - I would probably go apoplectic if I was your friend

Post reply on HN