Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DKIM2 and DMARCbis Have Landed

stalw.art

Post reply on HN
Print view View original

61–70 of 100 posts

Re: DKIM2 and DMARCbis Have Landed

#61

Post by bawolff »

SXX wrote: post #48

What always bugged me about whole email its that we still dont have two best and most reasonable practice to fight about abuse: 1 - Ability to pay once to provider give your domain Good reputation score to new or old domain and IP and whatever. Like pay once, be a good citizen. 2 - Or just use Hashcash or any other PoW. This would really solve a problem with 99.9% of spam and allow actually more decentrolized email s…

> Or just use Hashcash or any other PoW.

People love the idea of this, but i don't think it really makes sense.

How high do you set the PoW to? I dont think there is any middle ground that would actually deter attacks but not deter legit users.

Re: DKIM2 and DMARCbis Have Landed

#62

Post by TZubiri »

edelbitter wrote: post #53
Animats wrote: post #42

Questions: - How much infrastructure has to be fixed before this works, and in what order? - Can you send mail from something that doesn't have a DNS entry? How does this affect the first hop from a desktop or mobile SMTP client? - If an spam email came via SendGrid, Constant Spammer, or MailChump, are you going to be able to tell from the header signatures? - If your headers are correct, are you guaranteed mail boun…

> Can you send mail from something that doesn't have a DNS entry? You never really could. Participating in public email exchange requires that the sender can resolve then "fully qualified" domain in your return address. Except after prior agreement or authentication, messages simply that fail this are not generally accepted. > If your headers are correct, are you guaranteed mail bounces for un-deliverable emails? Eve…

>You never really could.

You can, open a TCP socket on port 25 to $IP, and just start sending email headers.

You can also use local domains, no DNS.

You can also leave a file in the /var/mail directory with the filename of the user.

Re: DKIM2 and DMARCbis Have Landed

#63

Post by reader9274 »

justusthane wrote: post #39
peanut-walrus wrote: post #15

Missed opportunity to get rid of SPF. What I want to my DMARC policy to say: if someone is sending you an email that claims to be from my domain and it's not signed by one of the keys I have published under my domain, you should reject it, regardless where it came from. And on the receiving side, the policy is similarly simple: if I receive any unsigned or unaligned email, I will reject it. Edit: to clarify, I want t…

Isn’t that already what DMARC does though? For DMARC to pass you need DKIM _or_ SPF alignment, not both. It’s designed that way because there are scenarios where SPF _can’t_ pass (email forwarding, mailing lists). So a well-configured mail server should accept your email regardless of SPF if DKIM is properly configured. Re: specific keys for specific usernames: I can appreciate that you wish DKIM allowed for this, an…

> Isn’t that already what DMARC does though? For DMARC to pass you need DKIM _or_ SPF alignment, not both.

But now if SPF passes and is aligned, DMARC passes (it doesn't matter what DKIM's status is). OP here wants to complete skip the SPF check entirely.

Re: DKIM2 and DMARCbis Have Landed

#64

Post by bawolff »

dataflow wrote: post #12

I really don't understand what the original DKIM was not sufficient. Can someone ELI5? If you can verify that a message (including headers, which DKIK can sign) was signed by the outgoing server, then why isn't that the end of the story? Who cares how or why it got forwarded, or whatever else?

> Who cares how or why it got forwarded, or whatever else?

Because it broke enough niche usecases that lots of people didn't feel comfortable fully turning on dmarc in strict mode. Fixing that will hopefully spike adoption

Re: DKIM2 and DMARCbis Have Landed

#65

Post by binkHN »

OneDeuxTriSeiGo wrote: post #17
qurren wrote: post #5

Aw hell. How many things do I have to set up just so that I can send e-mails from my own domain? The effect of all this seems to be less "making e-mail secure" and more "making it so that only Google, Apple, and Microsoft can send e-mail successfully"

DKIM2 and DMARCbis are actually the opposite of this. They are long awaited fixes of brittle and often broken systems that are designed to now make providing secure email easier rather than harder. They both have fairly clean migration paths and resolve a lot of the annoying edge cases that currently exist with authenticating and verifying email.

Thanks for this, it made me actually read the posted content, but there's a lot of content to digest and a lot MTAs will have to implement.

Re: DKIM2 and DMARCbis Have Landed

#66

Post by will4274 »

TZubiri wrote: post #58
brightball wrote: post #16

Earlier quoted context omitted.

DMARC isn't for sending email successfully, it's for preventing other people from impersonating your domain. Without it, there's nothing stopping anybody from sending an email saying it is from you@qurren.com. SPF tried. DKIM tried. Both of them had gaps. When you use them together and have a DMARC policy that requires one of them or the other for successful delivery, it's the best current solution.

Right, and when you don't configure DMARC successfully and the recipient requires DMARC, then you cannot send email successfully.

Yeah. And when you don't configure your TLS certificate correctly, people can't connect to your webpage.

The anti-email authenticity standards gang has always smelled like the anti-TLS gang to me.

Re: DKIM2 and DMARCbis Have Landed

#68

Post by denkmoon »

bombcar wrote: post #36
drdexebtjl wrote: post #33

Earlier quoted context omitted.

That is perfectly reasonable. Set it up correctly.

It is so much easier to set these things up with a frontier AI to walk you through the Byzantine steps.

It takes an afternoon to set up DKIM and DMARC from scratch on a debian VPS. Yeah it's a little bit byzantine but it's not rocket science.

Re: DKIM2 and DMARCbis Have Landed

#69

Post by comex »

I wonder how this post was composed. It's full of LLM-isms, but is also pretty informative and not too fluffy - basically, higher-quality than I'm used to seeing from LLM blog posts, especially at this length. Perhaps it was composed based on a detailed human outline? Or perhaps, could this be the power of Fable?

Re: DKIM2 and DMARCbis Have Landed

#70

Post by toast0 »

justusthane wrote: post #39
peanut-walrus wrote: post #15

Missed opportunity to get rid of SPF. What I want to my DMARC policy to say: if someone is sending you an email that claims to be from my domain and it's not signed by one of the keys I have published under my domain, you should reject it, regardless where it came from. And on the receiving side, the policy is similarly simple: if I receive any unsigned or unaligned email, I will reject it. Edit: to clarify, I want t…

Isn’t that already what DMARC does though? For DMARC to pass you need DKIM _or_ SPF alignment, not both. It’s designed that way because there are scenarios where SPF _can’t_ pass (email forwarding, mailing lists). So a well-configured mail server should accept your email regardless of SPF if DKIM is properly configured. Re: specific keys for specific usernames: I can appreciate that you wish DKIM allowed for this, an…

> Isn’t that already what DMARC does though? For DMARC to pass you need DKIM _or_ SPF alignment, not both.

GP wants require DKIM, so SPF alone is insufficient to send mail from their domains.

If everyone did dmarc, you could set SPF to -all. But there are servers that check SPF but not DMARC. You need to pass SPF for those, so you need a passable SPF... but then DMARC will pass with only SPF.

Post reply on HN