Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Spammers are better at SPF, DKIM, and DMARC than everyone else

toad.social

Post reply on HN
Print view View original

141–150 of 261 posts

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#141

Post by indrora »

grayhatter wrote: post #120

No they're not. I run my own email server. Most spam crap cannot pass spf/dkim. Although this post has caused me to sit up and notice that the trendline is moving in the unfortunate direction, where I'd say 3 years ago the ones that pass were about 1/4, today it feels like 40-60% pass. The amount of mail I get that I expect, passes spf/dkim at around 90-95% I suspect the delta between their any my results are the ver…

It’s far easier to buy the email addresses of known good people by buying dumps of websites that got breached.

Web scraping gets you a lot of fake emails, company sinkholes, and other low reward stuff. Paying $20 for 100k confirmed real emails with names? That’s gold.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#142

Post by kro »

Jzush wrote: post #138

My biggest problem with SPF, DKIM, DMARC is when you go to test this crap there's really only commercial apps. So people who are setting up things for a non-profit or a personal project are either forced to pay after doing 3 or 4 test emails or you wait like 24 hours or some crap. And all that just for the privilege of being able to send email to some gmail accounts. Trying to get email to properly encrypt is pulling…

Yopmail does verify and show these results for free when receiving a mail, this not even being their core feature

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#143

Post by lillecarl »

blacklion wrote: post #127
zelon88 wrote: post #108

Earlier quoted context omitted.

Sounds like an issue with an outdated locally hosted IP2 Location database.

Google thinks it is in Russia too. And Cloudflare thinks the same.

If it's Hurricane Electrics tunnel I've had similiar issues, I think they use Russian blocks for their IPv6 tunnel since the abuse potential is so high and they don't want to deal with it so they just bundle all their shit with Russia and move on.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#144

Post by thesuitonym »

teeray wrote: post #113
thesuitonym wrote: post #95

Earlier quoted context omitted.

> Actually getting SPF, DKIM and DMARC right and having a domain with a 0 spam score will still land you in the spam directory. This little bit of wisdom gets passed around all the time, but it's actually not true. You can send email from a brand new domain to Google and Microsoft and whoever just fine. What you can't do is send email from a brand new domain, and a brand new email server--or an email server on a VPS,…

> or an email server on a VPS, or an email server on a residential IP So what options are left for a self-hoster. Colo?

Get a business-grade connection from your ISP. Make sure they give you a static IP from their business side, and check its reputation before you set up email. If it has a bad reputation, make the ISP give you a different one.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#145

Post by Jzush »

kro wrote: post #142
Jzush wrote: post #138

My biggest problem with SPF, DKIM, DMARC is when you go to test this crap there's really only commercial apps. So people who are setting up things for a non-profit or a personal project are either forced to pay after doing 3 or 4 test emails or you wait like 24 hours or some crap. And all that just for the privilege of being able to send email to some gmail accounts. Trying to get email to properly encrypt is pulling…

Yopmail does verify and show these results for free when receiving a mail, this not even being their core feature

That’s good to know. I’ve not seen it mentioned anywhere. The tools I’ve used in the past give me 3 or 4 test emails before they require me to sign up.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#146

Post by toenail »

Jzush wrote: post #138

My biggest problem with SPF, DKIM, DMARC is when you go to test this crap there's really only commercial apps. So people who are setting up things for a non-profit or a personal project are either forced to pay after doing 3 or 4 test emails or you wait like 24 hours or some crap. And all that just for the privilege of being able to send email to some gmail accounts. Trying to get email to properly encrypt is pulling…

I use https://www.mail-tester.com/

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#147

Post by lisper »

I've been running my own spam filter for many years now based on this super-simple heuristic: My filter looks at my outgoing mail, and any mail received from an address I've sent mail to, or with a subject that has appeared in my outgoing mail (possibly with a "re:" prefix) is marked as non-spam. Everything else goes in spam, and any spam message from an address I've never received mail from before is marked as unread. I get hundreds of spams per day, but only about a dozen from new addresses. It takes me about ten seconds to scan them for non-spam cold calls, which are extremely rare. The other source of false positives is things like subscription confirmations, but because I know to expect those, they are always at the top of the spam folder.

I put this initial system in place expecting to have to augment it later with a more traditional content-based filter, but this simple heuristic works so well I've never felt the need to implement that additional step.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#148

Post by x0x0 »

xg15 wrote: post #85
upofadown wrote: post #34

SPF/DKIM is really about mail server reputation. So it mostly benefits larger servers like the ones run by Google, Microsoft and Yahoo. Unfortunately, that means that attempts by those larger providers to combat spam using such reputation will naturally hurt smaller providers. So the actual effects of SPF/DKIM are on the whole negative. The root problem is that we don't actually need to keep track of email server rep…

> We need to be able to treat anonymous email differently than email from people we actually know. The simplest solution to that would be an "only show me emails from people in my address book" filter. That would mostly echo how we treat user trust on all other platforms. Genuinely surprised this doesn't exist in most email clients (or does it and I have just overlooked it so far?) Of course that's only a partial sol…

> only a partial solution and wouldn't work for accounts where you expect unsolicited mails from people you don't know.

I actually think this would work fine. Imagine a quarantine inbox for new emailers that the user must scan and approve/block. This is exactly what hey has implemented.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#149

Post by kmeisthax »

nextn wrote: post #53

Spammers are worse at something no one tried to use AFAIK: require a fee to deliver email.

No, they will happily pay money to spam you.

IP reputation, proof-of-work, and various fee-for-receipt schemes are trying to solve spam in the same way: by charging low-volume users a trifle to send messages at a "normal" rate, which adds up to become more expensive when you start bulk mailing. The problem is that these schemes have to assume that there is a single market-clearing price[0] for sending messages that is both low enough to not inconvenience legitimate users and high enough to make bulk messaging uneconomic.

Such a concept goes against how communications networks actually function. The amount of communications resources the average person uses is so low that it's not worth billing for them. Sending any sort of data isn't free, but it's "cheap as free[1]". Any communications technology that bets against this will fail in the marketplace. People are not going to go back to, say, buying (virtual) stamps at 73 cents[2] a piece to send mail with. Hell, the $10/GB I pay with Google Fi is already enough to make me cringe every time I actively use my data plan.

On the other side, charging a fee for misbehavior legitimizes that misbehavior; if the fee is less than the value of the misbehavior then you are just imposing a cost of business. Spammers need to send lots of mail because the rate at which people fall for your scam is comically low. But when you do hook a sucker in, they yield a huge return.

So what we have here is that legitimate users would balk at per-message rates that wouldn't even be close to what would make spammers flinch. Which is, again, the same problem that SPF/DKIM/DMARC have. People whose job it is to send garbage e-mail for a living have a far higher tolerance for Internet bureaucracy bullshit[3] than people who use e-mail to get their real work done or to talk to friends and family.

[0] Getting your IP banned for spamming or having to burn energy brute-forcing a hash can be considered a price.

[1] Buy all our playsets and toys!

[2] Current price of USPS letter postage

[3] In the Graeberian sense

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#150

Post by gabeio »

robocat wrote: post #132
elcritch wrote: post #121

Earlier quoted context omitted.

Lots of companies do this on their websites now using cloud flare or something similar. It’s practical. Still it’s frustrating as a user when you’re traveling over in Europe and can’t access your accounts to pay bills or whatnot.

Next time I travel overseas I'll have a VPN ready. My bank had some technical problem that prevented access from overseas last time I traveled and I couldn't access my account (which was extremely inconvenient).

Most banks that will work with. For what ever reason the bank I now use knows most vpn providers and completely blocks all traffic from them so using a vpn is not an option either. The “vpn” I’ll have to use is tunneling back to my home ip. It’s actually quite frustrating.
Post reply on HN