Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Spammers are better at SPF, DKIM, and DMARC than everyone else

toad.social

Post reply on HN
Print view View original

121–130 of 261 posts

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#121

Post by elcritch »

smithkl42 wrote: post #105
CableNinja wrote: post #98

Earlier quoted context omitted.

Ive got a server hosting a number of things, amd monitoring setup for a lot of stats. Got tired of seeing blips because various countries were beating on my server, not a DoS, but enough requests to notice, and sometimes generate an alert. I blocked 7 countries, in full, and the impact was fantastic. No more 2gb of logs generated every day by countries that have no business accessing my server. Unless you own a globa…

I'm the CTO of a US-based insurance company. Apart from some reinsurers in London and Bermuda, and a couple contractors in Canada, we don't do business outside the US. We've blocked all countries except those, and it has cut down massively on the folks attacking us.

Lots of companies do this on their websites now using cloud flare or something similar. It’s practical. Still it’s frustrating as a user when you’re traveling over in Europe and can’t access your accounts to pay bills or whatnot.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#122

Post by toast0 »

teeray wrote: post #113
thesuitonym wrote: post #95

Earlier quoted context omitted.

> Actually getting SPF, DKIM and DMARC right and having a domain with a 0 spam score will still land you in the spam directory. This little bit of wisdom gets passed around all the time, but it's actually not true. You can send email from a brand new domain to Google and Microsoft and whoever just fine. What you can't do is send email from a brand new domain, and a brand new email server--or an email server on a VPS,…

> or an email server on a VPS, or an email server on a residential IP So what options are left for a self-hoster. Colo?

Find a host that cares about their reputation. It can be hard to know who responds to abuse reports, but if they mention it in their TOS that's a positive. Also, many hosts block outbound port 25 by default now; that's a positive sign as well.

The more effort you have to put in to use them to send mail, the more likely spammers don't use them, and the more likely their ip space has a positive or at least non-negative reputation for sending mail.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#123

Post by simiones »

johnisgood wrote: post #82
simiones wrote: post #77

Earlier quoted context omitted.

I think everyone can agree that any technology that "isn't complicated if you read the documentation" is by definition complicated. I don't need to read the documentation for Gmail to use Gmail successfully. Could I, as a trained programmer, use PGP and GPG? I'm sure I could if I spent some time reading about it. Could my 90 year old grandmother, who is otherwise quite comfortable with email and whatsapp? No, not to…

I highly disagree with this. I just left a couple of comments regarding the use of "strtok". Its use is straightforward, just RTFM. Those were the golden days when people were less reluctant to read documentation. You could not even install Linux back then without an installation guide of some sort. You still need it for Gentoo, perhaps even Arch or Void. Are they wrong? No, just different target audience. If you do…

> Are they wrong? No, just different target audience. If you do not want to become a "power user", that is fine.

Complicated doesn't mean bad. I'm not claiming that PGP or GPG are bad technologies because they are complicated to use.

> My grandma can barely handle the TV controller. So what? I am really against dumbing things down, called "ease-of-access" or whatever they call it these days.

The "so what" is simple: PGP is not the right anti-spam solution for your grandma, or mine, or any users like them. This is the context of this conversation: is PGP a good-enough answer for how to establish identity for email in the interest of anti-spam and anti-scam efforts? And the answer is a clear and resounding no, not for the vast majority of users of email.

This, again, doesn't mean that PGP/GPG are bad technologies - they are very good for certain use cases and certain users.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#124

Post by johnisgood »

simiones wrote: post #123
johnisgood wrote: post #82

Earlier quoted context omitted.

I highly disagree with this. I just left a couple of comments regarding the use of "strtok". Its use is straightforward, just RTFM. Those were the golden days when people were less reluctant to read documentation. You could not even install Linux back then without an installation guide of some sort. You still need it for Gentoo, perhaps even Arch or Void. Are they wrong? No, just different target audience. If you do…

> Are they wrong? No, just different target audience. If you do not want to become a "power user", that is fine. Complicated doesn't mean bad. I'm not claiming that PGP or GPG are bad technologies because they are complicated to use. > My grandma can barely handle the TV controller. So what? I am really against dumbing things down, called "ease-of-access" or whatever they call it these days. The "so what" is simple:…

So what is a good-enough answer for my grandma? :P

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#125

Post by toast0 »

dizhn wrote: post #91
riobard wrote: post #15

The point of SPF/DKIM/DMARC is to bind emails to domains, so no more spoofing. It is naive to expect authentication alone can reduce spams.

All of these technologies are basically DOA because of how fickle they are and for lack of support across the board. Most policies are set to not to deny. DMARC is nice though. It won't stop spam. It won't stop spoofing. But you will know that someone somewhere is spamming people using your domain name. How awesome. :)

I never found the DMARC reports actionable, so I quickly turned them off. What do you do with the information?

Of course, even with hard fail spf and dmarc, I still see some bounces from spam where some server accepted the mail to deliver it elsewhere and the next server denies it, so the first server sends me a bounce.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#126

Post by simiones »

bluGill wrote: post #103
simiones wrote: post #77

Earlier quoted context omitted.

I think everyone can agree that any technology that "isn't complicated if you read the documentation" is by definition complicated. I don't need to read the documentation for Gmail to use Gmail successfully. Could I, as a trained programmer, use PGP and GPG? I'm sure I could if I spent some time reading about it. Could my 90 year old grandmother, who is otherwise quite comfortable with email and whatsapp? No, not to…

There are times you need complexity enough to be worth training costs. There is one universal word "nanana", and maybe babies cry (it seems many babies have unique cries for different needs: I suspect that is training between babies and their parents - anyone done research on this?). All other language is because you spend years in training. If you can read this or write a response that implies training. The importan…

I absolutely agree that PGP/GPG have important use-cases for which they are the state of the art and well worth learning. This doesn't mean that they are not complicated technologies though.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#127

Post by blacklion »

zelon88 wrote: post #108
blacklion wrote: post #104

Earlier quoted context omitted.

But there are big problems with mapping from IPs to countries. My IPv6 is detected as Russian, though it is London-located tunnel exit point and I'm in the Netherlands.

Sounds like an issue with an outdated locally hosted IP2 Location database.

Google thinks it is in Russia too. And Cloudflare thinks the same.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#128

Post by snowwrestler »

tomw1808 wrote: post #24
chillfox wrote: post #22

Earlier quoted context omitted.

In most organizations there is no point in a sysadmin to spend the effort in understanding how to set it up correctly as Marketing has got more authority on email. Marketing will simply demand changes to the config that they do not understand and there is nothing you can do to stop it as they will have the CEO on their side.

to be fair here: for a lot of companies, if the mass mailing stops, the money-flow stops then that's no good for anyone... so the CEO will probably err on the side of money, presumably.

Why would properly configuring SPF, DKIM, and DMARC stop the mass mailing, though?

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#129

Post by simiones »

johnisgood wrote: post #124
simiones wrote: post #123

Earlier quoted context omitted.

> Are they wrong? No, just different target audience. If you do not want to become a "power user", that is fine. Complicated doesn't mean bad. I'm not claiming that PGP or GPG are bad technologies because they are complicated to use. > My grandma can barely handle the TV controller. So what? I am really against dumbing things down, called "ease-of-access" or whatever they call it these days. The "so what" is simple:…

So what is a good-enough answer for my grandma? :P

There's no great answer, unfortunately. Gmail and other off-the-shelf email providers handle much of the spam and some of the scam prevention for you, but you still need to exercise caution on your own.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#130

Post by JohnMakin »

chillfox wrote: post #22
jeroenhd wrote: post #5

For me, as someone with their own mail server, these technologies mostly serve to inform me that Russian IP addresses are still trying to send email in the name of my domain for some stupid reason. It makes sense that people whose business is sending email know how to set up email correctly. I'm mostly surprised at how many legitimate sysadmins struggle with getting the basics correct. Surely those dozens of DMARC em…

In most organizations there is no point in a sysadmin to spend the effort in understanding how to set it up correctly as Marketing has got more authority on email. Marketing will simply demand changes to the config that they do not understand and there is nothing you can do to stop it as they will have the CEO on their side.

even worse when you have even less control than that, if you run some type of hosting and are trying to convince non-technical clients (or even worse, non technical clients who think they are technical) to “please just add this record exactly as it says here to your domain” and they’re somehow unable to for months and months
Post reply on HN