Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Spammers are better at SPF, DKIM, and DMARC than everyone else

toad.social

Post reply on HN
Print view View original

11–20 of 261 posts

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#11

Post by b112 »

petemir wrote: post #8
csomar wrote: post #3

I am just having this problem. Actually getting SPF, DKIM and DMARC right and having a domain with a 0 spam score will still land you in the spam directory. It turns out, you need to have a "reputation"? before your email gets accepted into gmail. My head was spinning as to how that reputation will be built if your email just goes straight to spam. But sure, Linkedin emails are definitively not spam and their dark-pa…

I worked on this for a while, at a time and in a market where most of our recipients had @hotmail addresses. I discovered that mass email sending was akin to a "pay-to-win" game. We had/opted to acquire the services of a company "expert in email deliverability" (Return Path), who somehow provided detailed metrics of how our IPs were scored by MSFT. I always wondered why MSFT didn't provide those scores by themselves,…

Turn on dmarc reporting. There are loads of tools to read the resulting xml.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#12

Post by csomar »

jeroenhd wrote: post #9
csomar wrote: post #3

I am just having this problem. Actually getting SPF, DKIM and DMARC right and having a domain with a 0 spam score will still land you in the spam directory. It turns out, you need to have a "reputation"? before your email gets accepted into gmail. My head was spinning as to how that reputation will be built if your email just goes straight to spam. But sure, Linkedin emails are definitively not spam and their dark-pa…

It's easy, you just have to have a regular, decently sized volume of non-spam emails, and suddenly your email stops being marked as spam! The logic isn't even that bad. SPF and DKIM serve to prove to the email who the sender is. That doesn't mean much if the sender is a spammer. Verifying identity claims is only the first part in checking email for spam, the harder part is checking if that identity is someone you tru…

> It's easy, you just have to have a regular, decently sized volume of non-spam emails, and suddenly your email stops being marked as spam!

The domain is new and didn't send a single email until I tested it.

Edit: The domain is actually a bit old but was parked/inactive for a while, though the email was used only for receiving.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#13

Post by b112 »

citrin_ru wrote: post #6
mbb70 wrote: post #2

I'm sure regular airline passengers trip the metal detectors more often than terrorists, doesn't mean we should get rid of the metal detectors.

A better analogy would be a passport. It doesn’t stop all terrorists from boarding a plane at lest it stops already know to authorities ones (unless they have a passport on someone else’s name which is not easy).

Or perhaps, why do you lock the door to your house? A few solid kicks will open most doors, the locks can be picked, someone can smash windows and enter, and many modern homes can be entered by ripping the wall open with a crowbar and axe.

It's to stop midrange threats.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#14

Post by jeroenhd »

magicalhippo wrote: post #4

Moved my mail over to Proton and they had a very nice process that made it easy to add the required DNS entries and verify that they were correct. I was dreading this step as I hadn't done it before but turned out to be a breeze thanks to that.

I think the problem isn't necessarily that adding DNS entries is hard (especially compared to the rest of the process of hosting your own email), but that getting a clear overview of what email tools an organization uses is difficult.

You need IT to list all of the reporting tools, customer service to tell you about their support system, marketing to tell you about their mailing list tool of the week, the sales guys to warn you they're using this new AI email enhancer, and somehow get that shady email forwarding service the CEO uses to give up their mail server IP addresses. Then you need to figure out how to get coverage for all of those tools and keep on top of them whenever something changes.

A lot of companies promise to do great things for you if you just enter the email address you'd like to send email from, and a lot of people gloss over the important details because those sound hard and when they tested the tool on their personal email it worked fine so that's probably unnecessary anyway! Managing email for a corporate domain can be like herding cats.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#16

Post by jeroenhd »

csomar wrote: post #12
jeroenhd wrote: post #9

Earlier quoted context omitted.

It's easy, you just have to have a regular, decently sized volume of non-spam emails, and suddenly your email stops being marked as spam! The logic isn't even that bad. SPF and DKIM serve to prove to the email who the sender is. That doesn't mean much if the sender is a spammer. Verifying identity claims is only the first part in checking email for spam, the harder part is checking if that identity is someone you tru…

> It's easy, you just have to have a regular, decently sized volume of non-spam emails, and suddenly your email stops being marked as spam! The domain is new and didn't send a single email until I tested it. Edit: The domain is actually a bit old but was parked/inactive for a while, though the email was used only for receiving.

Yup, that'll get you stuck in spam limbo alright. Good luck climbing out if it if you're initiating conversations with anyone on Gmail or Outlook (or, even worse, corporate Outlook).

Those email services will usually have no trouble with replies to emails sent from their service, so if you get someone to email you first you'll save them the trouble of dragging your email from their spam folder to their inbox.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#17

Post by badmintonbaseba »

Naively I thought that one value proposition of SPF, DKIM and DMARC is that reputation shifts from based on IP to be based on domain, once you set these up correctly. So as long as you can maintain a good reputation for your domain and have SPF, DKIM and DMARC correctly set up, then you can host your SMTP server at any IP and your emails will get delivered.

I wonder why it doesn't work this way.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#18

Post by jeroenhd »

riobard wrote: post #15

The point of SPF/DKIM/DMARC is to bind emails to domains, so no more spoofing. It is naive to expect authentication alone can reduce spams.

To be fair, SPF saves mail.ru and outlook.com users from five, maybe six spam emails per month coming from my domain, based on DMARC reports. If those numbers scale to include every domain on the internet, that's a huge amount of spam being filtered out very easily and very early.

You'd think spammers would've learned to avoid SPF domains at the very least but they haven't, so despite SPF/DMARC/DKIM failing to get anyone out the spam folder, the technology is still catching spam bots.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#19

Post by arccy »

badmintonbaseba wrote: post #17

Naively I thought that one value proposition of SPF, DKIM and DMARC is that reputation shifts from based on IP to be based on domain, once you set these up correctly. So as long as you can maintain a good reputation for your domain and have SPF, DKIM and DMARC correctly set up, then you can host your SMTP server at any IP and your emails will get delivered. I wonder why it doesn't work this way.

domains are cheap and easy to get new ones. IPv4 addresses are limited so you can't burn them as freely.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#20

Post by cuu508 »

jeroenhd wrote: post #9
csomar wrote: post #3

I am just having this problem. Actually getting SPF, DKIM and DMARC right and having a domain with a 0 spam score will still land you in the spam directory. It turns out, you need to have a "reputation"? before your email gets accepted into gmail. My head was spinning as to how that reputation will be built if your email just goes straight to spam. But sure, Linkedin emails are definitively not spam and their dark-pa…

It's easy, you just have to have a regular, decently sized volume of non-spam emails, and suddenly your email stops being marked as spam! The logic isn't even that bad. SPF and DKIM serve to prove to the email who the sender is. That doesn't mean much if the sender is a spammer. Verifying identity claims is only the first part in checking email for spam, the harder part is checking if that identity is someone you tru…

And you have to build up the volume gradually. In the industry this is called "warming up IP addresses". See for example https://help.elasticemail.com/en/articles/2788598-how-to-war... or https://docs.aws.amazon.com/ses/latest/dg/dedicated-ip-warmi...
Post reply on HN