Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DMARC has been public since 2012 but most company domains still don't enforce it

ciphercue.com

Post reply on HN
Print view View original

151–160 of 185 posts

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#151

Post by inigyou »

TonyTrapp wrote: post #54

I have set up DMARC, SPF, DKIM and whatnot. Sadly no one seems to take this as a signal for a competent mail setup, so Microsoft's mail servers regularly block my mails because of the surrounding IP range reputation - not because any spam would originate from my IPs or domains.

Are you sending important or unimportant things?

When its unimportant or important to the receiver only, you push responsibility to them: "I sent it. Must be your email that's glithced. Tried Gmail or Proton?"

When its important to you, you use your backup Gmail or Proton account.

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#152

Post by inigyou »

BenjiWiebe wrote: post #108
vandyswa wrote: post #30

DMARC, just like SPF before it, solves nothing. The spammers adapt. And unlike SPF, DMARC has an enormous technology surface area. Its failure modes are legion, and each one is tedious to run down to resolution. Which just returns you to something which never pays the rent anyway.

One awesome thing that SPF/DKIM/DMARC did... Now that spammers have "adapted", it means they can't say their email is from @mybank.com, or @microsoft.com, or @facebook.com, etc!

Exactly. This is a very important step. The fact that it did not stop spam is irrelevant.

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#153

Post by inigyou »

account42 wrote: post #71
rft wrote: post #17

Article is missing a note on the existence of MX records for the domains. Sure, you can easily have a send-only domain without an MX record, but the common case is likely to setup both send and receive capability. It would be interesting to have that number included as domains without MX and DMARC might just not be configured for email at all. Worst case the 45% of domains without DMARC are simply not relevant for em…

Technically you can receive mail without MX records if your mail server is on the same host as the web server.

And if you send, a lot of mail servers will assume it's not meant to have any email service and will treat it as an SPF fail.

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#154

Post by inigyou »

at1as wrote: post #50

I’d be interested these stats broken down between domains associated with operating companies and personal or hobby domains. The latter are likely to adopt much more slowly simply because of less perceived risk, lower payoff (no vendor reviews), and less dedicated technical expertise. Just like personal sites were slow to adopt HTTPS. Mass HTTPS adoption happened once browser warnings and SEO incentives rendered site…

Mass HTTPS adoption happened when it stopped costing $100 every year and requiring three forms of KYC, which is after Snowden showed us why we really should be using it all the time.

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#155

Post by inigyou »

bombcar wrote: post #14
smartmic wrote: post #2

I am self-hosting my (secondary) email and have only implemented SPF and DKIM. This works fine on a practical level for me. What would be the benefit of setting up DMARC on top?

The biggest benefit I saw in a small domain was greatly reduced backscatter spam. Before someone’d randomly make up a billion emails on my domain and send “from” them, and I’d get various out of office replies, etc (catch all) - that basically never happens anymore.

That affects your reputation BTW as they have no way to know they aren't really from your domain.

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#156

Post by inigyou »

cube00 wrote: post #92
account42 wrote: post #72

Earlier quoted context omitted.

[citation needed]

When properly configured, particularly at an enforcement policy of p=quarantine or p=reject, DMARC can positively impact inbox placement. https://mxtoolbox.com/dmarc/details/email-deliverability

mxtoolbox isn't an email service provider. What email service provider does this?

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#158

Post by acdha »

inigyou wrote: post #142
acdha wrote: post #122

Earlier quoted context omitted.

@gmail.com and @outlook.com are like 90% of the spam I receive. What’s missing is effective accountability for those two companies hosting persistent spam groups who operate for months unimpeded.

Sue the spammer, getting a subpoena from Google to find their identity.

That surely is a sustainable and cost-effective alternative to Google using their trillions of dollars in resources to behave responsibly.

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#159

Post by brightball »

bcrl wrote: post #97
WorldMaker wrote: post #90

Earlier quoted context omitted.

Can we use DMARC to ask Gmail to close registrations? Google Calendar to allow far fewer people the ability to send invite notifications? Firebase to close registrations? Azure? Microsoft 365? AWS SES? It feels like the biggest spammers have swung back to just abusing SaaS and getting SPF / DKIM / DMARC for free from one of the big email providers.

Exactly this. Spammers have the technical competence to overcome any technical hurdle, so using evidence of technical competence achieves nothing. If it were possible to charge $0.25/email for delivery, I'd be more than happy . However, I'm sure large tech firms will need to say that is "too hard to implement at scale".

> using evidence of technical competence achieves nothing

Evidence of technical competence wasn't what I was talking about. I meant that it creates a trail of evidence for police to actually pursue them, particularly in the case of phishing.

To setup DMARC, DKIM and SPF you need to control a domain. Somebody has to own that domain, unless you just hacked a DNS or somebody's already configured email server.

If you hacked it, there's a trail to contact the domain owner to notify them. If you bought it, there's a trail to find the domain owner.

You can obfuscate that with stolen cards and fake registration details, but now there's a central point where identity validation and security can concentrate itself.

A lot of positive side effects happen when the bar is raised from "any email server can send email claiming to be from anybody" to "email can only be sent claiming to be from a domain if the domain approves the sending email server."

At least when the spam concentrates from major senders like Google, etc those major senders have the means to analyze and take steps to prevent it.

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#160

Post by Freebytes »

inigyou wrote: post #140
deknos wrote: post #129

Earlier quoted context omitted.

> Which is only the core problem because dmarc fixed the other core problem of figuring out who the given sender is. Does it verify the sender or the domain/service which the sender is using?

Yes. If an email comes from alice@gmail and validates to gmail, alice sent it. It's possible that gmail screwed up and gave Bob access to Alice's account. In this situation, though, Alice still sent it.

Google is not the only email provider in the world, though. Not all email services are global corporations, and we must be careful never to interrupt the services of independent email providers.
Post reply on HN