Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Spammers are better at SPF, DKIM, and DMARC than everyone else

toad.social

Post reply on HN
Print view View original

151–160 of 261 posts

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#151

Post by gus_massa »

wizzwizz4 wrote: post #54
jeroenhd wrote: post #52

Earlier quoted context omitted.

I've had to figure out a problem with reaching university Outlook servers where the Outlook server didn't like the (spec compliant) way my email server was writing the From address and rewrote it halfway through the spam filtering chain. Then it checked the DKIM signature on the message it REWROTE ON ITS OWN and decided that the signature didn't match, and rejected my email. Corporate email stacks are hell.

Do you have a write-up of this, anywhere? I'd appreciate the details (what format did it reject? what did it change it to? what version of Exchange?).

I second the request. A few years ago we switched to Google Workplace, but it would be nice to know. I would like to forward it to the sysadmins just in case we go back to our own server.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#152

Post by freedomben »

zelon88 wrote: post #111
jeroenhd wrote: post #5

For me, as someone with their own mail server, these technologies mostly serve to inform me that Russian IP addresses are still trying to send email in the name of my domain for some stupid reason. It makes sense that people whose business is sending email know how to set up email correctly. I'm mostly surprised at how many legitimate sysadmins struggle with getting the basics correct. Surely those dozens of DMARC em…

The problems I noticed were, it doesn't matter what the SPF and DKIM look like. If Google or Microsoft refuse to relay your email based on secret internal factors then you're out of business.

Yes, and they do that routinely.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#153

Post by Avamander »

Jzush wrote: post #138

My biggest problem with SPF, DKIM, DMARC is when you go to test this crap there's really only commercial apps. So people who are setting up things for a non-profit or a personal project are either forced to pay after doing 3 or 4 test emails or you wait like 24 hours or some crap. And all that just for the privilege of being able to send email to some gmail accounts. Trying to get email to properly encrypt is pulling…

You can always first send it to yourself and read the Authentication-Results header. Though even Gmail displays SPF/DKIM/DMARC status when you view the raw source of an email.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#154

Post by Avamander »

kbolino wrote: post #101
throw0101c wrote: post #88

Related: there are known problems with DKIM, and there's a DKIM2 effort: * https://datatracker.ietf.org/doc/draft-gondwana-dkim2-motiva... * https://datatracker.ietf.org/wg/dkim/about/ * https://blog.redsift.com/email/dkim/first-look-at-dkim2-the-... The recently-held IETF 122 had a session on it: * https://www.youtube.com/watch?v=o-0OKfyLlBs

I'd also like to see an update to DMARC so you can require both SPF and DKIM in your policy, instead of just one out of the two.

Terrible idea, SPF is very hostile to (legitimate) forwarding. In general SPF should actually die.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#155

Post by freedomben »

seer wrote: post #35
selykg wrote: post #29

Earlier quoted context omitted.

The problem I personally ran into as a one person IT department was that the VP of marketing had more power over me, as a manager, and that meant more to my supervisor (the CEO) than me fighting to do things as correctly as possible. I was seen as a roadblock or speed bump. So, they may not decide on DKIM and SPF, but if marketing isn’t happy then their negativity could cause push back that forces changes that may te…

As long as you're not breaking the law / hurting people, does the struggle really matter? The best way I've been able to make people listen to me is by just presenting them with options and results. If you do it this hacky way - we run this risk and this bad thing can happen etc. After a few times they see the consequence of their decisions people start paying attention to you. Do it a few more and now the company wi…

The biggest problem there is that it's a statistical gamble, and often times the damage isn't apparent for months or years later, which is plenty far enough removed from the decision that the manager isn't going to remember let alone realize "he told me so." And you reporting "I told you so" even in very easy, factual, and respectful professional language will typicall not be well received. There's also a decent chance that when the thing breaks or you get breached, you'll be blamed for it, or at least be on the defensive.

Now that said, I've worked with a lot of IT/engineering people who are pretty obstructionist to normal business operations and sometimes need to be told, "yeah, we're accepting the risk, move forward with the plan." Sometimes it's for good reasons, other times it's just our normal humanity asserting itself in different ways. It's a hard problem for sure.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#156

Post by EGreg »

lisper wrote: post #147

I've been running my own spam filter for many years now based on this super-simple heuristic: My filter looks at my outgoing mail, and any mail received from an address I've sent mail to, or with a subject that has appeared in my outgoing mail (possibly with a "re:" prefix) is marked as non-spam. Everything else goes in spam, and any spam message from an address I've never received mail from before is marked as unrea…

Someone posted on X advice that really helped me clean up my inbox

Add a filter looking for the word "Unsubscribe" and automatically put them in "Promotional" category or something similar. Also apply the filter to existing emails, and let it run for a minute.

Try it now! And comment if it reduced your inbox to like 2% of what it was :)

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#157

Post by bityard »

csomar wrote: post #3

I am just having this problem. Actually getting SPF, DKIM and DMARC right and having a domain with a 0 spam score will still land you in the spam directory. It turns out, you need to have a "reputation"? before your email gets accepted into gmail. My head was spinning as to how that reputation will be built if your email just goes straight to spam. But sure, Linkedin emails are definitively not spam and their dark-pa…

If it's a new domain, then your problem isn't reputation exactly, it's having a newly-registered domain. Buying a new domain, setting up the SPF, DKIM, and MARC, and then immediately spamming from it until it's banned everywhere a week later is standard spammer MO.

I've been self-hosting mail for me and my family for about 20 years and don't send nearly enough mail to have a "reputation" with anybody. Still, I don't have any problems with deliverability of mail.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#158

Post by Jzush »

Avamander wrote: post #153
Jzush wrote: post #138

My biggest problem with SPF, DKIM, DMARC is when you go to test this crap there's really only commercial apps. So people who are setting up things for a non-profit or a personal project are either forced to pay after doing 3 or 4 test emails or you wait like 24 hours or some crap. And all that just for the privilege of being able to send email to some gmail accounts. Trying to get email to properly encrypt is pulling…

You can always first send it to yourself and read the Authentication-Results header. Though even Gmail displays SPF/DKIM/DMARC status when you view the raw source of an email.

Which works great unless you're trying to debug gmail refusing your emails because of some issue or another.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#159

Post by ndriscoll »

EGreg wrote: post #156
lisper wrote: post #147

I've been running my own spam filter for many years now based on this super-simple heuristic: My filter looks at my outgoing mail, and any mail received from an address I've sent mail to, or with a subject that has appeared in my outgoing mail (possibly with a "re:" prefix) is marked as non-spam. Everything else goes in spam, and any spam message from an address I've never received mail from before is marked as unrea…

Someone posted on X advice that really helped me clean up my inbox Add a filter looking for the word "Unsubscribe" and automatically put them in "Promotional" category or something similar. Also apply the filter to existing emails, and let it run for a minute. Try it now! And comment if it reduced your inbox to like 2% of what it was :)

I've commented here before that it is obvious to me that gmail makes no effort to combat spam anymore given that unsubscribe links are legally required and generally present for spam in the US and are an obvious heuristic that aren't used. I would expect basically any trained filter to pick up on it, so my assumption is that they actually intentionally have rules to allow spam.

I get emails that literally say "This is an email advertisement". These are presumably being blasted out to tons of mailboxes. How does a model not notice this?

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#160

Post by Suzuran »

carlosjobim wrote: post #140
Suzuran wrote: post #65

Earlier quoted context omitted.

You may be surprised to learn that spammers, being criminals, have no issue with stealing money from others to spend on email delivery fees. Edit: Proof-of-work "email postage" schemes are similarly doomed - The botnet that zero-day'd your mail servers does not care how much electricity they use.

Criminals yes, criminal spammers no. If they could make money with other crime there would be no point in wasting their time with sending spam.

The point to sending the spam is to enable further crime. Do you really think they don't stand to profit from what they promote? Spam is a business like any other, they aren't going to magically disappear just because their advertising costs suddenly become non-zero. Just like how they found ways of shifting the costs of hosting mail servers onto others, they will find ways of shifting the costs of any "email postage" scheme onto others.
Post reply on HN