Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DKIM2 and DMARCbis Have Landed

stalw.art

Post reply on HN
Print view View original

21–30 of 100 posts

Re: DKIM2 and DMARCbis Have Landed

#21

Post by hinkley »

qurren wrote: post #5

Aw hell. How many things do I have to set up just so that I can send e-mails from my own domain? The effect of all this seems to be less "making e-mail secure" and more "making it so that only Google, Apple, and Microsoft can send e-mail successfully"

This sort of Regulatory Capture is quite old in the software field. People were already noticing it in the 90's.

Making a spec that contains a venn diagram of most of the features each of the signatories to the specification have implemented themselves ends up pulling the ladder up behind them. Each non-academic committee member discovers they're already more than 75% of the way to having completed the spec and any junior members or amateurs have years of work to do in order to catch up to Now. If any upstarts threaten to get within striking distance of an implementation you can always convene the committee again and discuss version 2 of the spec.

Mobile devices tamped this down just a little bit but mostly they lowered the slope of the line a hair and changed where the focus was a bit.

Re: DKIM2 and DMARCbis Have Landed

#22

Post by qurren »

brightball wrote: post #16
qurren wrote: post #5

Aw hell. How many things do I have to set up just so that I can send e-mails from my own domain? The effect of all this seems to be less "making e-mail secure" and more "making it so that only Google, Apple, and Microsoft can send e-mail successfully"

DMARC isn't for sending email successfully, it's for preventing other people from impersonating your domain. Without it, there's nothing stopping anybody from sending an email saying it is from you@qurren.com. SPF tried. DKIM tried. Both of them had gaps. When you use them together and have a DMARC policy that requires one of them or the other for successful delivery, it's the best current solution.

Except I think I've had 1:1 personal e-mails from my domain go into a legitimate recipient's spam filter just because I didn't have DMARC set up and their mail server was flagging that "DMARC not set up == spammy domain"

Re: DKIM2 and DMARCbis Have Landed

#23

Post by 1over137 »

doubled112 wrote: post #7
qurren wrote: post #5

Aw hell. How many things do I have to set up just so that I can send e-mails from my own domain? The effect of all this seems to be less "making e-mail secure" and more "making it so that only Google, Apple, and Microsoft can send e-mail successfully"

And sometimes if you do everything right, it still doesn’t work. Recently I checked the IP against blacklists, waited a few months, did all of the other things, and then found out Microsoft bounces my entire VPS’s IP range. Appealing did not help. They intermittently block Cloudflare email routing IPs too. All of these security measures and still it comes down to the IP address of your sender.

Is it an el cheapo VPS?

Re: DKIM2 and DMARCbis Have Landed

#24

Post by AlotOfReading »

TacticalCoder wrote: post #13
bigbuppo wrote: post #8

Can someone distill this down to how it will be used by the big three email providers to make it impossible to use email except through them?

> by the big three Which big three? Gmail has something like 1.8 billion users. iCloud mail around 1 billion. Microsoft with 400 million users of its email is closer to Yahoo! Mail (225 million users) than to the big two.

User numbers aren't the only factor. Microsoft has a much larger presence in commercial email than Apple. I suspect an outbound email from a personal provider is far more likely to be destined for an outlook inbox than one on iCloud.

Re: DKIM2 and DMARCbis Have Landed

#25

Post by crote »

brightball wrote: post #20
dataflow wrote: post #12

I really don't understand what the original DKIM was not sufficient. Can someone ELI5? If you can verify that a message (including headers, which DKIK can sign) was signed by the outgoing server, then why isn't that the end of the story? Who cares how or why it got forwarded, or whatever else?

There are a few gaps with DKIM. 1. You have to set it up on every sending server. It's easier today but it wasn't always 2. You have to periodically rotate each of the keys that you setup because they can be cracked/stolen. Soon as somebody steals your key, they can impersonate anyone sending email from your domain. 3. Receiving email servers have no way of knowing if a message they received without a DKIM signature…

2b. You have to publish the retired private keys, or else a recipient will retain undeniable proof of message authenticity.

Depending on your perspective, this can be either a feature or a bug.

Re: DKIM2 and DMARCbis Have Landed

#26

Post by dataflow »

brightball wrote: post #20
dataflow wrote: post #12

I really don't understand what the original DKIM was not sufficient. Can someone ELI5? If you can verify that a message (including headers, which DKIK can sign) was signed by the outgoing server, then why isn't that the end of the story? Who cares how or why it got forwarded, or whatever else?

There are a few gaps with DKIM. 1. You have to set it up on every sending server. It's easier today but it wasn't always 2. You have to periodically rotate each of the keys that you setup because they can be cracked/stolen. Soon as somebody steals your key, they can impersonate anyone sending email from your domain. 3. Receiving email servers have no way of knowing if a message they received without a DKIM signature…

1. I can't say I buy this excuse, but okay.

2. Is this an actual problem that has arisen with a worrying frequency in the past, or just a hypothetical? And how is it different from someone stealing your SSH key or TLS certificate?

3. Isn't it obvious from previous emails you've received from the same server?

Re: DKIM2 and DMARCbis Have Landed

#27

Post by doubled112 »

1over137 wrote: post #23
doubled112 wrote: post #7

Earlier quoted context omitted.

And sometimes if you do everything right, it still doesn’t work. Recently I checked the IP against blacklists, waited a few months, did all of the other things, and then found out Microsoft bounces my entire VPS’s IP range. Appealing did not help. They intermittently block Cloudflare email routing IPs too. All of these security measures and still it comes down to the IP address of your sender.

Is it an el cheapo VPS?

Is Cloudflare a cheapo VPS?

It is a cheap VPS, but it would still be nice if there was a way to know (not assume) beforehand.

> 550 5.7.1 Unfortunately, messages from [IP ADDRESS] weren't sent. Please contact your Internet service provider since part of their network is on our block list (S3150).

> Your IP(s) qualify for conditional mitigation.

Still blocked. The system is working as expected.

Re: DKIM2 and DMARCbis Have Landed

#28

Post by jeffbee »

doubled112 wrote: post #27
1over137 wrote: post #23

Earlier quoted context omitted.

Is it an el cheapo VPS?

Is Cloudflare a cheapo VPS? It is a cheap VPS, but it would still be nice if there was a way to know (not assume) beforehand. > 550 5.7.1 Unfortunately, messages from [IP ADDRESS] weren't sent. Please contact your Internet service provider since part of their network is on our block list (S3150). > Your IP(s) qualify for conditional mitigation. Still blocked. The system is working as expected.

I would simply like to point out that 550 at SMTP time is not a bounce.

Re: DKIM2 and DMARCbis Have Landed

#29

Post by yasaheblasa »

brightball wrote: post #20
dataflow wrote: post #12

I really don't understand what the original DKIM was not sufficient. Can someone ELI5? If you can verify that a message (including headers, which DKIK can sign) was signed by the outgoing server, then why isn't that the end of the story? Who cares how or why it got forwarded, or whatever else?

There are a few gaps with DKIM. 1. You have to set it up on every sending server. It's easier today but it wasn't always 2. You have to periodically rotate each of the keys that you setup because they can be cracked/stolen. Soon as somebody steals your key, they can impersonate anyone sending email from your domain. 3. Receiving email servers have no way of knowing if a message they received without a DKIM signature…

1&2 sound worse after this update as described.. I'm not really sure why we are still bothering with this when DNSSEC progress means DANE like setups could solve the original E2E S/MIME issues of payment and domain indicating expectation of what its email senders are required to have for S/MIME.

There are some aspects of (possibly positive) deniability by an individual that probably still remain with DKIM but they kind of remain anyway with domain anchored S/MIME.

Post reply on HN