Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Spammers are better at SPF, DKIM, and DMARC than everyone else

toad.social

Post reply on HN
Print view View original

111–120 of 261 posts

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#111

Post by zelon88 »

jeroenhd wrote: post #5

For me, as someone with their own mail server, these technologies mostly serve to inform me that Russian IP addresses are still trying to send email in the name of my domain for some stupid reason. It makes sense that people whose business is sending email know how to set up email correctly. I'm mostly surprised at how many legitimate sysadmins struggle with getting the basics correct. Surely those dozens of DMARC em…

The problems I noticed were, it doesn't matter what the SPF and DKIM look like. If Google or Microsoft refuse to relay your email based on secret internal factors then you're out of business.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#112

Post by jabroni_salad »

chillfox wrote: post #22
jeroenhd wrote: post #5

For me, as someone with their own mail server, these technologies mostly serve to inform me that Russian IP addresses are still trying to send email in the name of my domain for some stupid reason. It makes sense that people whose business is sending email know how to set up email correctly. I'm mostly surprised at how many legitimate sysadmins struggle with getting the basics correct. Surely those dozens of DMARC em…

In most organizations there is no point in a sysadmin to spend the effort in understanding how to set it up correctly as Marketing has got more authority on email. Marketing will simply demand changes to the config that they do not understand and there is nothing you can do to stop it as they will have the CEO on their side.

Orgs like that will hire consultants like me when they can't figure out why their stuff isn't landing in the inbox. Then 3 months later their webdev will somehow delete the entire zone when adding their A record.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#113

Post by teeray »

thesuitonym wrote: post #95
csomar wrote: post #3

I am just having this problem. Actually getting SPF, DKIM and DMARC right and having a domain with a 0 spam score will still land you in the spam directory. It turns out, you need to have a "reputation"? before your email gets accepted into gmail. My head was spinning as to how that reputation will be built if your email just goes straight to spam. But sure, Linkedin emails are definitively not spam and their dark-pa…

> Actually getting SPF, DKIM and DMARC right and having a domain with a 0 spam score will still land you in the spam directory. This little bit of wisdom gets passed around all the time, but it's actually not true. You can send email from a brand new domain to Google and Microsoft and whoever just fine. What you can't do is send email from a brand new domain, and a brand new email server--or an email server on a VPS,…

> or an email server on a VPS, or an email server on a residential IP

So what options are left for a self-hoster. Colo?

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#114

Post by dolmen »

arccy wrote: post #19
badmintonbaseba wrote: post #17

Naively I thought that one value proposition of SPF, DKIM and DMARC is that reputation shifts from based on IP to be based on domain, once you set these up correctly. So as long as you can maintain a good reputation for your domain and have SPF, DKIM and DMARC correctly set up, then you can host your SMTP server at any IP and your emails will get delivered. I wonder why it doesn't work this way.

domains are cheap and easy to get new ones. IPv4 addresses are limited so you can't burn them as freely.

Do you imply that sending e-mail via IPv6 doesn't work?

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#115

Post by ziddoap »

kasey_junk wrote: post #109
ziddoap wrote: post #106

Earlier quoted context omitted.

How/why did you pick these 7? Using your link: Ukraine, USA, UK, Brazil, & India all rank higher than Iran and Belarus. US & Ukraine rank higher than Nigeria and Romania.

Those countries likely have a higher chance of real traffic as well. If I’m doing business in Nigeria then obviously I can’t block it even if it ranks high on the threat level.

Yes, obviously you don't block the countries you plan to do business with. I got that much.

It probably makes sense to leave the US out of the list, assuming the CableNinja is in North America.

The rest seems pretty arbitrarily chosen, though. JumpCrisscross gave no additional context to why they left out Ukraine, Brazil, India, UK, when picking countries from the list they linked. They have higher cybercrime index ranks.

Whether they have a higher chance of "real" traffic is highly dependent on the business in question.

I'm sure there is some amount of thought behind the choice, beyond just using the index, which is why I'm asking.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#116

Post by jamespo »

CableNinja wrote: post #98
JumpCrisscross wrote: post #83

Earlier quoted context omitted.

> Russian IP addresses are still trying to send email in the name of my domain for some stupid reason For what it's worth, I've started seeing cybersecurity insurers requiring riders and extra payments if you don't block Russian IPs.

Ive got a server hosting a number of things, amd monitoring setup for a lot of stats. Got tired of seeing blips because various countries were beating on my server, not a DoS, but enough requests to notice, and sometimes generate an alert. I blocked 7 countries, in full, and the impact was fantastic. No more 2gb of logs generated every day by countries that have no business accessing my server. Unless you own a globa…

A nice GH project for this: https://github.com/friendly-bits/geoip-shell?tab=readme-ov-f...

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#117

Post by pixl97 »

ipaddr wrote: post #71
tigeroil wrote: post #32

Earlier quoted context omitted.

You mean like the time I had a salesperson demanding that we turn off Cloudflare across our entire domain because he'd read some random article somewhere saying we should?

The goal of sales isn't to block upto a 1/3 of world wide traffic. Turning off Cloudfare means more traffic and more sales are not blocked. Did you even read the article or did you dismiss it because it came from 'sales'.

Sales: "look, I turned this off and sales went way up"

Security: "We had to cancel every single one of those sales because they came from stolen credit cards. It's costing us more to deal with that then we are earning"

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#118

Post by artee_49 »

DKIM is not meant to block spam, it's meant to authenticate that the sender had access to the private key for the public key exposed on the domain that it was sent from, implying that the sender has sufficient permissions to send from the domain.

It should not be used to imply anything else, none of these have anything to do with spam, that's reputation (and yes, having DKIM set-up boosts your reputation but it is not sufficient) and should be "built" up by the domains sending the emails.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#119

Post by artee_49 »

badmintonbaseba wrote: post #17

Naively I thought that one value proposition of SPF, DKIM and DMARC is that reputation shifts from based on IP to be based on domain, once you set these up correctly. So as long as you can maintain a good reputation for your domain and have SPF, DKIM and DMARC correctly set up, then you can host your SMTP server at any IP and your emails will get delivered. I wonder why it doesn't work this way.

It does work that way, but IP reputation is a thing as well so you need to keep that in mind. IPs need to be "seasoned" and "trusted" as well as domains.

This is how email-as-infra works, you're sending from a shared pool of their ips and they sign your emails with DKIM and you'll have SPF set up as well on your own.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#120

Post by grayhatter »

No they're not.

I run my own email server. Most spam crap cannot pass spf/dkim. Although this post has caused me to sit up and notice that the trendline is moving in the unfortunate direction, where I'd say 3 years ago the ones that pass were about 1/4, today it feels like 40-60% pass. The amount of mail I get that I expect, passes spf/dkim at around 90-95%

I suspect the delta between their any my results are the very restrictive sender rules I have prior to accept. In addition any_address@domain goes to my default mailbox, so I'm also probably selecting for laziness a bit more than most.

I also publish an email address without obfuscation on my site, which is getting very little spam, (near zero) which makes me wonder if most spam has given up on scraping the Internet for emails these days.

Post reply on HN