[flagged]
DMARC has been public since 2012 but most company domains still don't enforce it
101–110 of 185 posts
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#102Earlier quoted context omitted.
Yes and no. DKIM signs part of the envelope to help recipients detect alteration (by verifying authenticity), SPF locks down the permissible origins for the sender. SPF is in itself imperfect and can in some situations be exploited on open-access shared systems. If the two are used in concert they offer decent protection.
Using both has to be done very carefully, because a positive result from the weaker one (SPF) will override a negative result from the stronger one (DKIM). You should maximally use DKIM and minimally use SPF. Ideally, you should not use SPF at all, but there are some senders that still don't support DKIM.
The "logical OR" of DMARC is absolutely a glaring caveat. I run my own MX and would personally under no circumstance omit SPF, because I consider neither SPF nor DKIM complicated enough to warrant consideration.
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#103The domains that do enforce DMARC are apparently configured so badly that the German secure email provider mailbox.org decided not to honor DMARC.
See this thread in German: https://userforum.mailbox.org/topic/10676-mailbox-org-akzept...
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#104Earlier quoted context omitted.
Can we use DMARC to ask Gmail to close registrations? Google Calendar to allow far fewer people the ability to send invite notifications? Firebase to close registrations? Azure? Microsoft 365? AWS SES? It feels like the biggest spammers have swung back to just abusing SaaS and getting SPF / DKIM / DMARC for free from one of the big email providers.
Exactly this. Spammers have the technical competence to overcome any technical hurdle, so using evidence of technical competence achieves nothing. If it were possible to charge $0.25/email for delivery, I'd be more than happy . However, I'm sure large tech firms will need to say that is "too hard to implement at scale".
Stamp costs don't stop snail mail spam, either, unfortunately. I would be concerned if we added something like bitcoin fees to email delivery rather than curtail spam it would just further encourage grifters seeking ROI on their spam deliveries.
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#105Sadly the article doesn't really touch on whether or not DMARC accomplishes anything truly useful. When I enabled DMARC for ingress email on one of my own mail servers, it ultimately ended up regularly blocking a handful emails from customers, yet virtually all the spam coming in had valid SPF / DKIM / DMARC, as do most of the phishing attacks. The core problem is that the real need of email end users need is a way o…
[deleted]
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#106Email has been turned into a by-the-corporation, for-the-corporation service. Corporations need DMARC so they can control email and the ability to spam. The spam I cannot block is spam from Google. If you decide to think about this, you will quickly realize that email is f*ked and needs to be forked. Perhaps we need a Community Email Initiative that blocks corporations and only allows Community members. Trust is the…
You can do this right now, and you don't even need to fork anything. E-mail is an internet scale protocol that's not owned or ownable, except by convention. Since you specifically want to cut out Google, and their attempts to capture E-mail are what makes rolling your own E-mail hard anyway, just go for it. Depending on how hard you want to make it, you can slap all the parts together yourself or use something like Z…
What I am proposing is that community email servers can talk to each other. I have email servers setup - all the hoops - for my community. I want others to set up community servers and be able to interoperate. My server can send and receive from other communities. No corporations, no tracking. If your sever spams it gets dropped from the federation.
Yes it is more complex, and there will be problems and issues. But hey, if we can have crypto currency why can't we get emails?
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#107Given how much spam has valid DMARC/DKIM it is just useless.
Turns out making absolutely sure email isn't faked means jack shit if user isn't even looking at it, or the spoofed domains looks "close enough".
Currently the big pile of mail "security" extensions is basically useless pile of waste that just gives mail server admins some extra work.
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#108DMARC, just like SPF before it, solves nothing. The spammers adapt. And unlike SPF, DMARC has an enormous technology surface area. Its failure modes are legion, and each one is tedious to run down to resolution. Which just returns you to something which never pays the rent anyway.
One awesome thing that SPF/DKIM/DMARC did... Now that spammers have "adapted", it means they can't say their email is from @mybank.com, or @microsoft.com, or @facebook.com, etc!
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#109Earlier quoted context omitted.
I have a long-standing email address that forwards to an email system that I run. The operator of the forwarder switched to using Microsoft's mail infrastructure some years ago and the quality of service of the forward has degraded dramatically ever since. I've often seen messages resent by Microsoft's mail infrastructure with gratuitously broken DKIM signatures, generally due to changes to whitespace that are not an…
I never understood the point of the anti-virus adding a message to _outgoing_ emails. Basically "I swear there is no virus in this email I'm sending you, trust me bro".
[deleted]
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#110Earlier quoted context omitted.
Exactly this. Spammers have the technical competence to overcome any technical hurdle, so using evidence of technical competence achieves nothing. If it were possible to charge $0.25/email for delivery, I'd be more than happy . However, I'm sure large tech firms will need to say that is "too hard to implement at scale".
Stamp costs don't stop snail mail spam, either, unfortunately. I would be concerned if we added something like bitcoin fees to email delivery rather than curtail spam it would just further encourage grifters seeking ROI on their spam deliveries.
What if a single email cost $0.001 cent to send, and it was paid to the recipient? For $10, you could send 10,000 emails. For recipients, every 1,000 emails they get is a dollar in their wallet. You’d need something like a blockchain for this to work because the traditional payment processors still haven’t figured out micropayments.