Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DKIM2 and DMARCbis Have Landed

stalw.art

Post reply on HN
Print view View original

51–60 of 100 posts

Re: DKIM2 and DMARCbis Have Landed

#51

Post by inigyou »

zbentley wrote: post #45
assimpleaspossi wrote: post #40

Earlier quoted context omitted.

>>parasites that will pump resources and diminish the value of the system. Countries' legal systems really need to do something about them.

I don’t think they can. Spam, like speeding on highways and drug sales, is such an asymmetric enforcement area that I have very limited confidence that legal enforcement would make a significant dent in the volume. It’s far too technically easy to anonymously, repeatedly break anti-spam laws. This is an area where consortium enforcement (like the big inbox providers pushing solutions like DKIM2) is probably the most…

They keep finding that huge spam campaigns were run by one guy from his bedroom. I can't remember which specific spam campaign was recently caught, it might've been the phone spam about car insurance. It was one guy with a huge botnet.

In total they are a finite set, and even catching 5% of them will scare the rest.

Re: DKIM2 and DMARCbis Have Landed

#52

Post by inigyou »

peanut-walrus wrote: post #15

Missed opportunity to get rid of SPF. What I want to my DMARC policy to say: if someone is sending you an email that claims to be from my domain and it's not signed by one of the keys I have published under my domain, you should reject it, regardless where it came from. And on the receiving side, the policy is similarly simple: if I receive any unsigned or unaligned email, I will reject it. Edit: to clarify, I want t…

And I want mine to say: if it comes from my MX server it's legit, don't worry about the keys.

Because that's easy and keys and signing are hard.

Re: DKIM2 and DMARCbis Have Landed

#53

Post by edelbitter »

Animats wrote: post #42

Questions: - How much infrastructure has to be fixed before this works, and in what order? - Can you send mail from something that doesn't have a DNS entry? How does this affect the first hop from a desktop or mobile SMTP client? - If an spam email came via SendGrid, Constant Spammer, or MailChump, are you going to be able to tell from the header signatures? - If your headers are correct, are you guaranteed mail boun…

> Can you send mail from something that doesn't have a DNS entry?

You never really could. Participating in public email exchange requires that the sender can resolve then "fully qualified" domain in your return address. Except after prior agreement or authentication, messages simply that fail this are not generally accepted.

> If your headers are correct, are you guaranteed mail bounces for un-deliverable emails?

Even better: You are more likely to see an immediate refusal instead of a delayed bounce, if the recipient exchange can during transmission already determine that they do not want message claiming to be originally transmitted from X to Y yet breaking their ability to check the signature added by X.

Re: DKIM2 and DMARCbis Have Landed

#54

Post by edelbitter »

SXX wrote: post #48

What always bugged me about whole email its that we still dont have two best and most reasonable practice to fight about abuse: 1 - Ability to pay once to provider give your domain Good reputation score to new or old domain and IP and whatever. Like pay once, be a good citizen. 2 - Or just use Hashcash or any other PoW. This would really solve a problem with 99.9% of spam and allow actually more decentrolized email s…

In a way, the "let the money decide who is a good citizen" already works. Just not in our favor: Most of the spam I receive is not from some rando using an IP I know nothing about. Its from providers that keep making good money with their current anti-abuse.. strategy. As much as I would like, I cannot refuse all mail from certain providers, because some of their customers are "important" and non-abusive. But I get the good and the bad all laundered together¹.

¹) Some do allow recipients to distinguish, e.g. Sendgrid add an X-Entity-ID header which is a stable 1:1 or :1 map between short ascii identifiers and customers. So if you store that mapping, you can reject the usual "From: but not sent using the account associated with bigcorp.example". (The way they easily could, if they cared.)

Re: DKIM2 and DMARCbis Have Landed

#55

Post by brightball »

dataflow wrote: post #26
brightball wrote: post #20

Earlier quoted context omitted.

There are a few gaps with DKIM. 1. You have to set it up on every sending server. It's easier today but it wasn't always 2. You have to periodically rotate each of the keys that you setup because they can be cracked/stolen. Soon as somebody steals your key, they can impersonate anyone sending email from your domain. 3. Receiving email servers have no way of knowing if a message they received without a DKIM signature…

1. I can't say I buy this excuse, but okay. 2. Is this an actual problem that has arisen with a worrying frequency in the past, or just a hypothetical? And how is it different from someone stealing your SSH key or TLS certificate? 3. Isn't it obvious from previous emails you've received from the same server?

1. There are a lot of domains out there and all of the people who own them aren't necessarily technical enough to setup DKIM on their mail server. Ideally those people are using some type of service. SPF is much simpler in this regard.

2. This is a rather famous story about it happening.

https://www.wired.com/2012/10/dkim-vulnerability-widespread/

I have no idea how widespread the issue is today but I had to do some analysis on it when I worked for dmarcian ahead of the Anti-Phishing Working Group conference and we found that a significant percentage of email from known malicious IPs associated with reported phishing was passing DKIM. Key rotation removes the problem. Many services like ProtonMail and Sendgrid will set you up with 2 CNAME's for your DKIM keys so that they can rotate them for you automatically.

3. Domains send emails from multiple servers. Sometimes dedicated email servers, Google/Outlook, Sendgrid, email marketing tools, etc. A receiving system has no way to validate whether any of the tools sending email claiming to be from your domain are actually from your domain. The first time you look at a DMARC report for a domain that's been around for a while, you will typically see that 90% or more of the messages claiming to be from your domain weren't from you at all.

Re: DKIM2 and DMARCbis Have Landed

#56

Post by TZubiri »

doubled112 wrote: post #27
1over137 wrote: post #23

Earlier quoted context omitted.

Is it an el cheapo VPS?

Is Cloudflare a cheapo VPS? It is a cheap VPS, but it would still be nice if there was a way to know (not assume) beforehand. > 550 5.7.1 Unfortunately, messages from [IP ADDRESS] weren't sent. Please contact your Internet service provider since part of their network is on our block list (S3150). > Your IP(s) qualify for conditional mitigation. Still blocked. The system is working as expected.

You can't have the cake and eat it too.

Either you use cheap infrastructure that attackers can buy by the bulk for sybil attacks.

Or you pay a reasonable price for a slice of an IP block that doesn't share its reputation with elcheapos.

Re: DKIM2 and DMARCbis Have Landed

#57

Post by TZubiri »

jeffbee wrote: post #43
b112 wrote: post #41

Earlier quoted context omitted.

5xx are bounces, a perm failure. 4xx error codes are temp (retry) errors.

Incorrect. A bounce is a delivery status notification generated by a mailer after it has already accepted a message for delivery. A 5xx permanent error is a refusal to accept the message in the first place.

Is this standarized terminology in some RFC like SMTP? Or is it presumably some well established folk lingo?

Re: DKIM2 and DMARCbis Have Landed

#58

Post by TZubiri »

brightball wrote: post #16
qurren wrote: post #5

Aw hell. How many things do I have to set up just so that I can send e-mails from my own domain? The effect of all this seems to be less "making e-mail secure" and more "making it so that only Google, Apple, and Microsoft can send e-mail successfully"

DMARC isn't for sending email successfully, it's for preventing other people from impersonating your domain. Without it, there's nothing stopping anybody from sending an email saying it is from you@qurren.com. SPF tried. DKIM tried. Both of them had gaps. When you use them together and have a DMARC policy that requires one of them or the other for successful delivery, it's the best current solution.

Right, and when you don't configure DMARC successfully and the recipient requires DMARC, then you cannot send email successfully.

Re: DKIM2 and DMARCbis Have Landed

#59

Post by bawolff »

Animats wrote: post #42

Questions: - How much infrastructure has to be fixed before this works, and in what order? - Can you send mail from something that doesn't have a DNS entry? How does this affect the first hop from a desktop or mobile SMTP client? - If an spam email came via SendGrid, Constant Spammer, or MailChump, are you going to be able to tell from the header signatures? - If your headers are correct, are you guaranteed mail boun…

> If an spam email came via SendGrid, Constant Spammer, or MailChump, are you going to be able to tell from the header signatures?

Couldn't you always tell this from headers? At the very least the recieved headers are going to be a give away.

Re: DKIM2 and DMARCbis Have Landed

#60

Post by TZubiri »

peanut-walrus wrote: post #15

Missed opportunity to get rid of SPF. What I want to my DMARC policy to say: if someone is sending you an email that claims to be from my domain and it's not signed by one of the keys I have published under my domain, you should reject it, regardless where it came from. And on the receiving side, the policy is similarly simple: if I receive any unsigned or unaligned email, I will reject it. Edit: to clarify, I want t…

>Missed opportunity to get rid of SPF.

> you should reject it, regardless where it came from.

Just don't use it yourself then?

"v=spf1 ?all"

Post reply on HN