Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DKIM2 and DMARCbis Have Landed

stalw.art

Post reply on HN
Print view View original

31–40 of 100 posts

Re: DKIM2 and DMARCbis Have Landed

#31

Post by doubled112 »

jeffbee wrote: post #28
doubled112 wrote: post #27

Earlier quoted context omitted.

Is Cloudflare a cheapo VPS? It is a cheap VPS, but it would still be nice if there was a way to know (not assume) beforehand. > 550 5.7.1 Unfortunately, messages from [IP ADDRESS] weren't sent. Please contact your Internet service provider since part of their network is on our block list (S3150). > Your IP(s) qualify for conditional mitigation. Still blocked. The system is working as expected.

I would simply like to point out that 550 at SMTP time is not a bounce.

You get an email bounce back with an error code in it. Is there some other definition I'm unaware of?

Wait, that is probably from the local mailer, and otherwise the sender may never know about the rejected messages.

Re: DKIM2 and DMARCbis Have Landed

#32

Post by drhagen »

They spent a huge amount of complexity supporting mailing lists that claim mutated messages came FROM the original sender instead of FROM mailinglist@example.com. Is that use-case worth the additional effort?

Re: DKIM2 and DMARCbis Have Landed

#33

Post by drdexebtjl »

qurren wrote: post #22
brightball wrote: post #16

Earlier quoted context omitted.

DMARC isn't for sending email successfully, it's for preventing other people from impersonating your domain. Without it, there's nothing stopping anybody from sending an email saying it is from you@qurren.com. SPF tried. DKIM tried. Both of them had gaps. When you use them together and have a DMARC policy that requires one of them or the other for successful delivery, it's the best current solution.

Except I think I've had 1:1 personal e-mails from my domain go into a legitimate recipient's spam filter just because I didn't have DMARC set up and their mail server was flagging that "DMARC not set up == spammy domain"

That is perfectly reasonable. Set it up correctly.

Re: DKIM2 and DMARCbis Have Landed

#34

Post by bombcar »

qurren wrote: post #22
brightball wrote: post #16

Earlier quoted context omitted.

DMARC isn't for sending email successfully, it's for preventing other people from impersonating your domain. Without it, there's nothing stopping anybody from sending an email saying it is from you@qurren.com. SPF tried. DKIM tried. Both of them had gaps. When you use them together and have a DMARC policy that requires one of them or the other for successful delivery, it's the best current solution.

Except I think I've had 1:1 personal e-mails from my domain go into a legitimate recipient's spam filter just because I didn't have DMARC set up and their mail server was flagging that "DMARC not set up == spammy domain"

Too many admins just had it set to “no valid DMARC? Spam” instead of the more proper “failed DMARC? spam”.

Which is subtly different.

Re: DKIM2 and DMARCbis Have Landed

#36

Post by bombcar »

drdexebtjl wrote: post #33
qurren wrote: post #22

Earlier quoted context omitted.

Except I think I've had 1:1 personal e-mails from my domain go into a legitimate recipient's spam filter just because I didn't have DMARC set up and their mail server was flagging that "DMARC not set up == spammy domain"

That is perfectly reasonable. Set it up correctly.

It is so much easier to set these things up with a frontier AI to walk you through the Byzantine steps.

Re: DKIM2 and DMARCbis Have Landed

#37

Post by bombcar »

drhagen wrote: post #32

They spent a huge amount of complexity supporting mailing lists that claim mutated messages came FROM the original sender instead of FROM mailinglist@example.com. Is that use-case worth the additional effort?

Yes. Mailing lists are incredibly useful and very hard to change.

Re: DKIM2 and DMARCbis Have Landed

#38

Post by bombcar »

crote wrote: post #25
brightball wrote: post #20

Earlier quoted context omitted.

There are a few gaps with DKIM. 1. You have to set it up on every sending server. It's easier today but it wasn't always 2. You have to periodically rotate each of the keys that you setup because they can be cracked/stolen. Soon as somebody steals your key, they can impersonate anyone sending email from your domain. 3. Receiving email servers have no way of knowing if a message they received without a DKIM signature…

2b. You have to publish the retired private keys, or else a recipient will retain undeniable proof of message authenticity. Depending on your perspective, this can be either a feature or a bug.

The fallout from this has barely begun to be felt. It’s more important than the hypothetical quantum crypto stuff imo.

Re: DKIM2 and DMARCbis Have Landed

#39

Post by justusthane »

peanut-walrus wrote: post #15

Missed opportunity to get rid of SPF. What I want to my DMARC policy to say: if someone is sending you an email that claims to be from my domain and it's not signed by one of the keys I have published under my domain, you should reject it, regardless where it came from. And on the receiving side, the policy is similarly simple: if I receive any unsigned or unaligned email, I will reject it. Edit: to clarify, I want t…

Isn’t that already what DMARC does though? For DMARC to pass you need DKIM _or_ SPF alignment, not both. It’s designed that way because there are scenarios where SPF _can’t_ pass (email forwarding, mailing lists). So a well-configured mail server should accept your email regardless of SPF if DKIM is properly configured.

Re: specific keys for specific usernames: I can appreciate that you wish DKIM allowed for this, and I could imagine it being handy, but that was never the problem DKIM set out to solve — DKIM and SPF are all about be domain.

I’m also not sure it’s a great idea — the sender identity should be under the control of the sender. If you control the domain @foo.com, you could use that ability to assert that an email came from Bob, even if Bob never sent it. Contrast that with Bob signing the email using his own private key.

Re: DKIM2 and DMARCbis Have Landed

#40

Post by assimpleaspossi »

AceJohnny2 wrote: post #18
qurren wrote: post #5

Aw hell. How many things do I have to set up just so that I can send e-mails from my own domain? The effect of all this seems to be less "making e-mail secure" and more "making it so that only Google, Apple, and Microsoft can send e-mail successfully"

> Aw hell. How many things do I have to set up just so that I can send e-mails from my own domain? ... said every spammer. I'm sorry for your pain, and I'm in the same boat. But it's important to understand that any sufficiently large, distributed-agent system (like federated email), will see the rise of parasites that will pump resources and diminish the value of the system. What we're seeing here is an "immune" res…

>>parasites that will pump resources and diminish the value of the system.

Countries' legal systems really need to do something about them.

Post reply on HN