Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DMARC has been public since 2012 but most company domains still don't enforce it

ciphercue.com

Post reply on HN
Print view View original

141–150 of 185 posts

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#141

Post by inigyou »

WorldMaker wrote: post #90
brightball wrote: post #58

Earlier quoted context omitted.

> virtually all the spam coming in had valid SPF / DKIM / DMARC, as do most of the phishing attacks. This should create a means to go after the domain owners via registrar and trail of ownership, even so far as blocking email from the domain. Forcing the spammers to pass DMARC creates a burden and an evidence trail that didn't exist before.

Can we use DMARC to ask Gmail to close registrations? Google Calendar to allow far fewer people the ability to send invite notifications? Firebase to close registrations? Azure? Microsoft 365? AWS SES? It feels like the biggest spammers have swung back to just abusing SaaS and getting SPF / DKIM / DMARC for free from one of the big email providers.

Google now requires you to send them an SMS to open a new account. Also, Google got banned from Usenet (yes, the whole thing, yes really) because it only ever sent spam.

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#142

Post by inigyou »

acdha wrote: post #122
illliillll wrote: post #99

Earlier quoted context omitted.

What spammers are using the same domain for longer than couple of hours? What do you expect to achieve by blocking an already abandoned domain?

@gmail.com and @outlook.com are like 90% of the spam I receive. What’s missing is effective accountability for those two companies hosting persistent spam groups who operate for months unimpeded.

Sue the spammer, getting a subpoena from Google to find their identity.

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#143

Post by inigyou »

bigstrat2003 wrote: post #121
ryandrake wrote: post #118

Earlier quoted context omitted.

Perfect example of "The Purpose Of A System Is What It Does."[1] 1: https://en.wikipedia.org/wiki/The_purpose_of_a_system_is_wha...

That saying is bullshit. The purpose of a system is, by definition, what it is intended to do, not what it does. You can judge efficacy by the results, but not the purpose.

No, the entire purpose of the POSIWID principle is to refute what you just said. Do read the wikipedia page linked above. You called it out yourself when you said "by definition" - there is definition, and then there is reality, and they need not align.

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#144

Post by inigyou »

wafflebot wrote: post #81
HenriTEL wrote: post #78

Earlier quoted context omitted.

Isn't that the purpose of DKIM and SPF already?

DKIM and SPF validate a message. DMARC sets a policy as to what to do with it (quarantine/reject.)

So DMARC is just advertising whether you think your SPF and DKIM are set up correctly?

Seems useless to me. SPF already specifies what to do with messages that fail SPF. SPF is necessary. DKIM is questionable. DMARC is useless.

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#145

Post by inigyou »

Geezus_42 wrote: post #134
EvanAnderson wrote: post #21

I mind email for a number of small orgs (<1000 recipients each). There are so many SPF and DKIM failures from senders who you'd think would know better (Fortune 100-type companies). I don't want complaints from users missing messages so I end up disregarding failures even when published policy says to do otherwise.

I don't get it. Neither one is hard to setup. How do people have such a hard time with such simple configuration. Then again the majority of "mail admins" I have interacted with have absolutely no understanding of SMTP and can barely wrap their heads around DNS. I've had more than one argue with me that having more than 10 lookups in the SPF isn't the issue even though I am showing them the SPF failure and the RFC st…

DKIM is hard to set up. SPF is easy.

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#146

Post by inigyou »

TheChaplain wrote: post #20

If you have any domains that does not use email, it may be a good idea to set up some DNS records to prevent it being used. DNS SPF record: mydomain.io. TXT "v=spf1 -all" DNS DMARC: _dmarc.mydomain.io. TXT "v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s" That ought to stop anyone trying to use your domains as source.

Isn't it default for domains without MX records, usually?

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#147

Post by inigyou »

jwr wrote: post #9

I really think we should be solving a much bigger problem of the major email providers not providing an automated way of handling abuse and not caring about abuse reports at all. Most of my spam comes from the three major email providers and at this point I gave up even trying to send abuse reports because they just get ignored. The big companies do not have to care because nobody will block Google, Microsoft or Amaz…

As a rule of thumb, big companies only listen to lawsuits.

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#148

Post by teddyh »

auscompgeek wrote: post #138
teddyh wrote: post #49

Earlier quoted context omitted.

Also consider (using your example domain): *.mydomain.io. TXT "v=spf1 -all" to restrict SPF on all subdomains.

Specifying sp=reject in a DMARC policy would have a similar effect right?

The wildcard DNS SPF record is useful for mail receivers who won’t check DMARC, but will check SPF records. Also, the DMARC sp= setting defaults to the same as the p= setting (unless the DMARC record is itselt on a subdomain, in which case the sp= setting is ignored). So if you already have a strict p=reject setting, the sp= setting is useless.

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#149

Post by inigyou »

talkingtab wrote: post #15

Email has been turned into a by-the-corporation, for-the-corporation service. Corporations need DMARC so they can control email and the ability to spam. The spam I cannot block is spam from Google. If you decide to think about this, you will quickly realize that email is f*ked and needs to be forked. Perhaps we need a Community Email Initiative that blocks corporations and only allows Community members. Trust is the…

You can't solve a social or political problem with a technical solution. Whatever you invent, Microsoft and Google will still collude to block you and not each other.

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#150

Post by inigyou »

talkingtab wrote: post #106
baron3dl wrote: post #19

Earlier quoted context omitted.

You can do this right now, and you don't even need to fork anything. E-mail is an internet scale protocol that's not owned or ownable, except by convention. Since you specifically want to cut out Google, and their attempts to capture E-mail are what makes rolling your own E-mail hard anyway, just go for it. Depending on how hard you want to make it, you can slap all the parts together yourself or use something like Z…

What I am proposing is that community email servers can talk to each other. I have email servers setup - all the hoops - for my community. I want others to set up community servers and be able to interoperate. My server can send and receive from other communities. No corporations, no tracking. If your sever spams it gets dropped from the federation. Yes it is more complex, and there will be problems and issues. But h…

We have this, it's called email. Until someone involved is using Google or Microsoft.

myserver.com can talk to yourserver.com just fine and since neither of us have insane spam filters set up, it just works and no megacorpo is involved.

The protocol is okay, it just needs more smaller operators including smaller spam blocklists.

Post reply on HN