Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DKIM2 and DMARCbis Have Landed

stalw.art

Post reply on HN
Print view View original

41–50 of 100 posts

Re: DKIM2 and DMARCbis Have Landed

#41

Post by b112 »

jeffbee wrote: post #28
doubled112 wrote: post #27

Earlier quoted context omitted.

Is Cloudflare a cheapo VPS? It is a cheap VPS, but it would still be nice if there was a way to know (not assume) beforehand. > 550 5.7.1 Unfortunately, messages from [IP ADDRESS] weren't sent. Please contact your Internet service provider since part of their network is on our block list (S3150). > Your IP(s) qualify for conditional mitigation. Still blocked. The system is working as expected.

I would simply like to point out that 550 at SMTP time is not a bounce.

5xx are bounces, a perm failure. 4xx error codes are temp (retry) errors.

Re: DKIM2 and DMARCbis Have Landed

#42

Post by Animats »

Questions:

- How much infrastructure has to be fixed before this works, and in what order?

- Can you send mail from something that doesn't have a DNS entry? How does this affect the first hop from a desktop or mobile SMTP client?

- If an spam email came via SendGrid, Constant Spammer, or MailChump, are you going to be able to tell from the header signatures?

- If your headers are correct, are you guaranteed mail bounces for un-deliverable emails?

Re: DKIM2 and DMARCbis Have Landed

#43

Post by jeffbee »

b112 wrote: post #41
jeffbee wrote: post #28

Earlier quoted context omitted.

I would simply like to point out that 550 at SMTP time is not a bounce.

5xx are bounces, a perm failure. 4xx error codes are temp (retry) errors.

Incorrect. A bounce is a delivery status notification generated by a mailer after it has already accepted a message for delivery. A 5xx permanent error is a refusal to accept the message in the first place.

Re: DKIM2 and DMARCbis Have Landed

#44

Post by ericpauley »

peanut-walrus wrote: post #15

Missed opportunity to get rid of SPF. What I want to my DMARC policy to say: if someone is sending you an email that claims to be from my domain and it's not signed by one of the keys I have published under my domain, you should reject it, regardless where it came from. And on the receiving side, the policy is similarly simple: if I receive any unsigned or unaligned email, I will reject it. Edit: to clarify, I want t…

Best way to go about this is just blackhole SPF so it never passes, then set your DMARC alignment to strict. This approach prevents SPF from satisfying DMARC on the vast majority of providers [1].

[1] https://taejoong.github.io/files/publications/hamza-2026-dma...

Re: DKIM2 and DMARCbis Have Landed

#45

Post by zbentley »

assimpleaspossi wrote: post #40
AceJohnny2 wrote: post #18

Earlier quoted context omitted.

> Aw hell. How many things do I have to set up just so that I can send e-mails from my own domain? ... said every spammer. I'm sorry for your pain, and I'm in the same boat. But it's important to understand that any sufficiently large, distributed-agent system (like federated email), will see the rise of parasites that will pump resources and diminish the value of the system. What we're seeing here is an "immune" res…

>>parasites that will pump resources and diminish the value of the system. Countries' legal systems really need to do something about them.

I don’t think they can. Spam, like speeding on highways and drug sales, is such an asymmetric enforcement area that I have very limited confidence that legal enforcement would make a significant dent in the volume. It’s far too technically easy to anonymously, repeatedly break anti-spam laws. This is an area where consortium enforcement (like the big inbox providers pushing solutions like DKIM2) is probably the most effective.

Don’t get me wrong, there are tons of areas where countries’ legal systems have no excuse for not enforcing the law more stringently (e.g. flagrant corruption in multiple regulatory bodies’ failure to enforce investment/wire fraud). But spam is part of the other category—technically difficult enough to crack down on that legal action is a waste of time. There are ways to change that, but they’re all either more centralization-prone, worse for privacy/liberty, or extremely expensive.

Re: DKIM2 and DMARCbis Have Landed

#46

Post by zbentley »

Animats wrote: post #42

Questions: - How much infrastructure has to be fixed before this works, and in what order? - Can you send mail from something that doesn't have a DNS entry? How does this affect the first hop from a desktop or mobile SMTP client? - If an spam email came via SendGrid, Constant Spammer, or MailChump, are you going to be able to tell from the header signatures? - If your headers are correct, are you guaranteed mail boun…

> Can you send mail from something that doesn't have a DNS entry?

I hope not. Just like SSL, I think requiring a registrar+DNS server to vouch for a durable identity is an important barrier to abuse (and an important intervention point for violation reports).

Re: DKIM2 and DMARCbis Have Landed

#47

Post by edelbitter »

drhagen wrote: post #32

They spent a huge amount of complexity supporting mailing lists that claim mutated messages came FROM the original sender instead of FROM mailinglist@example.com. Is that use-case worth the additional effort?

Yes! Forwarding is the reason mail flow authentication does not work very well today. Fix the forwarding use cases (and by extension: mailing lists & out of office arrangements) and we can finally just tell all senders: "Your domains do not match, please use DMARC so we can automatically detect whether that is OK. No excuses, no exemptions, your use case can be dealt with using DMARC!"

Re: DKIM2 and DMARCbis Have Landed

#48

Post by SXX »

What always bugged me about whole email its that we still dont have two best and most reasonable practice to fight about abuse:

1 - Ability to pay once to provider give your domain Good reputation score to new or old domain and IP and whatever. Like pay once, be a good citizen.

2 - Or just use Hashcash or any other PoW.

This would really solve a problem with 99.9% of spam and allow actually more decentrolized email system.

Fact that no matter what you do its impossible to setup own emaik server to just send few emails a year with 100% guaranteed delivery is just beyond me.

Re: DKIM2 and DMARCbis Have Landed

#50

Post by inigyou »

doubled112 wrote: post #27
1over137 wrote: post #23

Earlier quoted context omitted.

Is it an el cheapo VPS?

Is Cloudflare a cheapo VPS? It is a cheap VPS, but it would still be nice if there was a way to know (not assume) beforehand. > 550 5.7.1 Unfortunately, messages from [IP ADDRESS] weren't sent. Please contact your Internet service provider since part of their network is on our block list (S3150). > Your IP(s) qualify for conditional mitigation. Still blocked. The system is working as expected.

Cloudflare is one of the shadiest hosts around, almost as bad as the big three clouds.
Post reply on HN