Live data from Hacker News

DMARC has been public since 2012 but most company domains still don't enforce it

ciphercue.com

111–120 of 185 posts

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#111

Earlier quoted context omitted.

Isn't that the purpose of DKIM and SPF already?

ELI5: https://www.reddit.com/r/sysadmin/comments/16gvtdj/comment/k...

Wish I didn't have to log in to reddit to read that post. RIP useful reddit links.

edit: looks like I had an extension that was redirecting to old.reddit.com, and it was old reddit that required login. Though when I turned that extension off, I got a "blocked by reddit security" error. ugggh.

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#113
At our small 12-person company, I help manage DNS. Email service is through Microsoft. I had previously configured SPF and DKIM etc. but never DMARC. We are too small to have time for everything. But, I recently asked Claude to review the entire config and recommend changes. It suggested DMARC. I said, "implement it". And it did. It does have access to our Cloudflare/DNS account and make changes using terraform/opentofu in a way that allows me to review the changes before they are made.

LLMs are great for this sort of thing that used to be a massive pain in the rear.

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#114
post #110

Earlier quoted context omitted.

Stamp costs don't stop snail mail spam, either, unfortunately. I would be concerned if we added something like bitcoin fees to email delivery rather than curtail spam it would just further encourage grifters seeking ROI on their spam deliveries.

What if a single email cost $0.001 cent to send, and it was paid to the recipient? For $10, you could send 10,000 emails. For recipients, every 1,000 emails they get is a dollar in their wallet. You’d need something like a blockchain for this to work because the traditional payment processors still haven’t figured out micropayments.

If snail mail cost $0.001 per recipient people would be getting much, much more junkmail. Likewise, if e-mail cost as much as even bulk snail mail, there'd be much less spam.

Some sort of payment scheme is really the best, most durable option. The problem of mailing-lists and personal correspondence could be solved by an exclusion mechanism where the recipient effectively whitelists senders, explicitly or implicitly (e.g. whitelist a replying-sender automatically if a recipient initiates a conversation).

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#115

If you have any domains that does not use email, it may be a good idea to set up some DNS records to prevent it being used. DNS SPF record: mydomain.io. TXT "v=spf1 -all" DNS DMARC: _dmarc.mydomain.io. TXT "v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s" That ought to stop anyone trying to use your domains as source.

Also, if your domain doesn't receive mail, set up a null mx record:

  @ IN MX 0 .
https://datatracker.ietf.org/doc/rfc7505/

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#117
post #114
post #110

Earlier quoted context omitted.

What if a single email cost $0.001 cent to send, and it was paid to the recipient? For $10, you could send 10,000 emails. For recipients, every 1,000 emails they get is a dollar in their wallet. You’d need something like a blockchain for this to work because the traditional payment processors still haven’t figured out micropayments.

If snail mail cost $0.001 per recipient people would be getting much, much more junkmail. Likewise, if e-mail cost as much as even bulk snail mail, there'd be much less spam. Some sort of payment scheme is really the best, most durable option. The problem of mailing-lists and personal correspondence could be solved by an exclusion mechanism where the recipient effectively whitelists senders, explicitly or implicitly…

The problem with a payment scheme is that spammers (who make money by spamming) will happily pay as a cost of doing business (or negotiate discounts/deals), but Joe User might just look at the cost and say, "you know what, maybe I'll send this as SMS instead of E-mail."

So the end result will be more spam and fewer legit E-mails.

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#118
post #95

Earlier quoted context omitted.

Then you don't deal with email in the real world. DMARC prevents legitimate emails from people in the real world from being delivered because people make mistakes with their email systems. Passing DMARC is not a signal that the email isn't legitimate; it's merely a sign that someone correctly set up their mail server to modern standards. The email might be an impersonation, or not. There's no way to know. DMARC does…

Okay but that doesn’t detract from the intended purpose of DMARC.

Perfect example of "The Purpose Of A System Is What It Does."[1]

1: https://en.wikipedia.org/wiki/The_purpose_of_a_system_is_wha...

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#119

Email has been turned into a by-the-corporation, for-the-corporation service. Corporations need DMARC so they can control email and the ability to spam. The spam I cannot block is spam from Google. If you decide to think about this, you will quickly realize that email is f*ked and needs to be forked. Perhaps we need a Community Email Initiative that blocks corporations and only allows Community members. Trust is the…

Yes, email is just completely broken. It's not private, sender identification is mediocre at best (and nonexistent without things like DMARC and SPF), and all the kludges thrown up make self-hosting harder. Spam has zero cost basically also. Nobody trusts email anymore for anything confidential, it's become a clumsy notification service "come check our portal for your real email". It's time for a new protocol with en…

[dead]

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#120

Earlier quoted context omitted.

You can do this right now, and you don't even need to fork anything. E-mail is an internet scale protocol that's not owned or ownable, except by convention. Since you specifically want to cut out Google, and their attempts to capture E-mail are what makes rolling your own E-mail hard anyway, just go for it. Depending on how hard you want to make it, you can slap all the parts together yourself or use something like Z…

What I am proposing is that community email servers can talk to each other. I have email servers setup - all the hoops - for my community. I want others to set up community servers and be able to interoperate. My server can send and receive from other communities. No corporations, no tracking. If your sever spams it gets dropped from the federation. Yes it is more complex, and there will be problems and issues. But h…

let's say this federation has three communities, a, b, and c. you run a, I run b, and my spammy friend runs c. C is my friend, and I'm going to keep allowing him to send me email, but you drop him, because he spammed you.

that's literally how email works today, unless the federation can supersede my authority as an operator to choose who may send/receive with me, at which point it'd stop being a federation anyway.

Post reply on HN