Earlier quoted context omitted.
Stamp costs don't stop snail mail spam, either, unfortunately. I would be concerned if we added something like bitcoin fees to email delivery rather than curtail spam it would just further encourage grifters seeking ROI on their spam deliveries.
What if a single email cost $0.001 cent to send, and it was paid to the recipient? For $10, you could send 10,000 emails. For recipients, every 1,000 emails they get is a dollar in their wallet. You’d need something like a blockchain for this to work because the traditional payment processors still haven’t figured out micropayments.
DMARC has been public since 2012 but most company domains still don't enforce it
131–140 of 185 posts
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#132Sadly the article doesn't really touch on whether or not DMARC accomplishes anything truly useful. When I enabled DMARC for ingress email on one of my own mail servers, it ultimately ended up regularly blocking a handful emails from customers, yet virtually all the spam coming in had valid SPF / DKIM / DMARC, as do most of the phishing attacks. The core problem is that the real need of email end users need is a way o…
^ this Additionally, I would probably guess correctly that almost all spam comes from rotating ASNs these days. Aka from companies that do "growth marketing" or other bullshit that isn't a valid business but just... spamming people. A lot of the domains that fall through the cracks for single-spam-campaigns have been taken over by botnet campaigns, so the actual owners of said domains probably don't know that their w…
Why would you care about TLS for spam? Are you proposing that any email sent without TLS should be label spam?
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#133Earlier quoted context omitted.
ELI5: https://www.reddit.com/r/sysadmin/comments/16gvtdj/comment/k...
Wish I didn't have to log in to reddit to read that post. RIP useful reddit links. edit: looks like I had an extension that was redirecting to old.reddit.com, and it was old reddit that required login. Though when I turned that extension off, I got a "blocked by reddit security" error. ugggh.
[–]iceph03nix
655 points 2 years ago
SPF: These are the servers I will send from. If it says it's from me, but comes from somewhere else, it's likely fake
DKIM: This is my signature, if it's not on the email, it probably didn't come from my server.
DMARC: If you get mail that doesn't match the above, here's what I want you to do with it.
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#134I mind email for a number of small orgs (<1000 recipients each). There are so many SPF and DKIM failures from senders who you'd think would know better (Fortune 100-type companies). I don't want complaints from users missing messages so I end up disregarding failures even when published policy says to do otherwise.
I don't get it. Neither one is hard to setup. How do people have such a hard time with such simple configuration. Then again the majority of "mail admins" I have interacted with have absolutely no understanding of SMTP and can barely wrap their heads around DNS.
I've had more than one argue with me that having more than 10 lookups in the SPF isn't the issue even though I am showing them the SPF failure and the RFC stating that you are not allowed more than 10. Like, good for you that Gmail doesn't care, we do, fix your shit.
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#135Earlier quoted context omitted.
I take the opposite approach, I refuse to whitelist domains. When someone internal complains I send a notice to their contact on the other end (CCing the internal recipient) saying their email is misconfigured and ask them to put me in touch with their IT department to help them fix it. I use a script to do some DNS lookups and write the email for me. I have about a 50% success rate getting them to fix it.
What happens in the other 50%? Your users work around you somehow?
Falls outside scope.
Only half joking. If you can't figure out SPF/DKIM then you should find a new job.
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#136Earlier quoted context omitted.
LLMs are very good at helping you manage DMARC/DNS related configuration, even as a non-expert. I used it to develop custom DMARC report processing app that: 1. sucks in reports sent to our dmarc inbox into a sqlite db, 2. displays the results in a web page. The reports queue up in the mailbox and I open and start the app once a month to check the status. The agent also also reviewed the state of email-related DNS re…
Sounds nice, but it adds to the load. Small businesses consider their direct customers much more important, and have little time for this kind of thing. Managing a domain is more work than godaddy makes you believe...
SPF, DKIM, and DMARC are not hard. It's literally just publishing data you should already have, a list of your sending IPs, a pubkey, and how to reach you.
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#137I really think we should be solving a much bigger problem of the major email providers not providing an automated way of handling abuse and not caring about abuse reports at all. Most of my spam comes from the three major email providers and at this point I gave up even trying to send abuse reports because they just get ignored. The big companies do not have to care because nobody will block Google, Microsoft or Amaz…
Agreed, most spam has valid DMARC - whether that's bigmail.com or just nobodcarestoprotectsubdomains.randompwnedcompany.com
The purpose of DMARC has nothing to do with stopping spam.
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#138If you have any domains that does not use email, it may be a good idea to set up some DNS records to prevent it being used. DNS SPF record: mydomain.io. TXT "v=spf1 -all" DNS DMARC: _dmarc.mydomain.io. TXT "v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s" That ought to stop anyone trying to use your domains as source.
Also consider (using your example domain): *.mydomain.io. TXT "v=spf1 -all" to restrict SPF on all subdomains.
Specifying sp=reject in a DMARC policy would have a similar effect right?
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#139I mind email for a number of small orgs (<1000 recipients each). There are so many SPF and DKIM failures from senders who you'd think would know better (Fortune 100-type companies). I don't want complaints from users missing messages so I end up disregarding failures even when published policy says to do otherwise.
I take the opposite approach, I refuse to whitelist domains. When someone internal complains I send a notice to their contact on the other end (CCing the internal recipient) saying their email is misconfigured and ask them to put me in touch with their IT department to help them fix it. I use a script to do some DNS lookups and write the email for me. I have about a 50% success rate getting them to fix it.
Good on you!
Re: DMARC has been public since 2012 but most company domains still don't enforce it
#140Earlier quoted context omitted.
> The core problem is that the real need of email end users need is a way of determining whether or not to trust a given sender. Which is only the core problem because dmarc fixed the other core problem of figuring out who the given sender is. DMARC does not solve everything, but it does make other solutions more effective.
> Which is only the core problem because dmarc fixed the other core problem of figuring out who the given sender is. Does it verify the sender or the domain/service which the sender is using?
Yes. If an email comes from alice@gmail and validates to gmail, alice sent it.
It's possible that gmail screwed up and gave Bob access to Alice's account. In this situation, though, Alice still sent it.