Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What DMARC Protects You From, and What It Does Not

senderledger.com

Post reply on HN
Print view View original

21–30 of 47 posts

Re: What DMARC Protects You From, and What It Does Not

#21

Post by dylan604 »

oogali wrote: post #18
actionfromafar wrote: post #16

Earlier quoted context omitted.

Url seems to be https://docs.rspamd.com/modules/dmarc/

Thanks for the correction. I guess I had a mis-paste that stripped out the leading part of the hostname... weird.

This just brought back bad memories of websites manipulating the clipboard when copying text. The ones that append the website attribution with full URL is a crime against humanity.

Re: What DMARC Protects You From, and What It Does Not

#22

Post by ksajadi »

avian wrote: post #5

Vaguely related question: what is the go-to open DMARC check implementation these days? I mean the part that checks _received_ mail against DMARC rules. It used to be opendmarc, but it seems people have been dropping it for a while because of history of breaking changes and general lack of good stewardship [1]. Anyone using pydmarc [2]? It's hard to find good info on this since 99% of search hits are people talking a…

We use sendops.dev for that and the rest of reputation management on AWS.

Re: What DMARC Protects You From, and What It Does Not

#23

Post by ddevnyc »

sam_lowry_ wrote: post #3

> Every email carries two "from" addresses I made a presentation about exactly the same subject many years ago, but I was not shy of separating the SMTP protocol (RFC 821 and the following ) and the email message (RFC 822 and the following). It makes the link between SPF, DKIM and DMARC much clearer. Anyway. The article covers just the bare minimum, and in the most obscure way. For those interested in the inner worki…

I'm sure I don't speak just for myself when I ask, can you link the presentation?

Re: What DMARC Protects You From, and What It Does Not

#24

Post by johncalvinyoung »

joladev wrote: post #10

> Here is the part that trips people up. It's hard to take something seriously when it's very clearly AI generated. It's just a coin toss on whether the information in the article is correct.

Yeah. I know what DMARC does, I run a mail server, but I thought it might be an interesting blog post nonetheless. It was very very obviously generated text, and not particularly information-dense or insightful. Gave up on reading it halfway through.

Re: What DMARC Protects You From, and What It Does Not

#25

Post by kube-system »

sylware wrote: post #6

I think DMARC is missing email address with IPv[46] literals support. As being self-hosted, without paying the DNS mob, I am still blocked to send email to gmail.com because such email addresses do throw out of whack gogol code. Email addresses with IPv[46] literals are intrinsincly stronger than SPF. If in the envelope or any of the 'from' headers (if my memory does not fail me, there are few more headers to scan),…

It is not a conspiracy theory that it is hard to maintain reliable delivery with self-hosting email. It is primarily because email filters are in part based on trust relationships, and huge amounts of spam come (or at least, did) from relatively unknown originating servers.

Re: What DMARC Protects You From, and What It Does Not

#26

Post by sam_lowry_ »

ddevnyc wrote: post #23
sam_lowry_ wrote: post #3

> Every email carries two "from" addresses I made a presentation about exactly the same subject many years ago, but I was not shy of separating the SMTP protocol (RFC 821 and the following ) and the email message (RFC 822 and the following). It makes the link between SPF, DKIM and DMARC much clearer. Anyway. The article covers just the bare minimum, and in the most obscure way. For those interested in the inner worki…

I'm sure I don't speak just for myself when I ask, can you link the presentation?

I can't share all of it, but to understand the relationship between SPF, DKIM and DMARC one should know that DMARC covers two possible cases. Either DKIM domain must match From: domain or MAIL FROM domain must match the From: domain plus the IP address of the sender should pass the SPF check

https://mikhailian.mova.org/delivering-mails/1.png shows the SMTP plaintext chat for the first case,

https://mikhailian.mova.org/delivering-mails/2.png shows the second.

Re: What DMARC Protects You From, and What It Does Not

#27

Post by ciupicri »

sam_lowry_ wrote: post #3

> Every email carries two "from" addresses I made a presentation about exactly the same subject many years ago, but I was not shy of separating the SMTP protocol (RFC 821 and the following ) and the email message (RFC 822 and the following). It makes the link between SPF, DKIM and DMARC much clearer. Anyway. The article covers just the bare minimum, and in the most obscure way. For those interested in the inner worki…

If only I could read those articles without joining LinkedIn.

Re: What DMARC Protects You From, and What It Does Not

#29

Post by PunchyHamster »

sylware wrote: post #6

I think DMARC is missing email address with IPv[46] literals support. As being self-hosted, without paying the DNS mob, I am still blocked to send email to gmail.com because such email addresses do throw out of whack gogol code. Email addresses with IPv[46] literals are intrinsincly stronger than SPF. If in the envelope or any of the 'from' headers (if my memory does not fail me, there are few more headers to scan),…

Most people don't own their IP range so it's moot point to support it.
Post reply on HN