Live data from Hacker News

Spammers are better at SPF, DKIM, and DMARC than everyone else

toad.social

161–170 of 261 posts

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#161
post #147

I've been running my own spam filter for many years now based on this super-simple heuristic: My filter looks at my outgoing mail, and any mail received from an address I've sent mail to, or with a subject that has appeared in my outgoing mail (possibly with a "re:" prefix) is marked as non-spam. Everything else goes in spam, and any spam message from an address I've never received mail from before is marked as unrea…

[deleted]

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#162
post #147

I've been running my own spam filter for many years now based on this super-simple heuristic: My filter looks at my outgoing mail, and any mail received from an address I've sent mail to, or with a subject that has appeared in my outgoing mail (possibly with a "re:" prefix) is marked as non-spam. Everything else goes in spam, and any spam message from an address I've never received mail from before is marked as unrea…

I'm using something very similar, except incoming messages from never-seen-before senders are greylisted instead:

https://en.wikipedia.org/wiki/Greylisting_(email)

95% of spammers never retry.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#163
post #162
post #147

I've been running my own spam filter for many years now based on this super-simple heuristic: My filter looks at my outgoing mail, and any mail received from an address I've sent mail to, or with a subject that has appeared in my outgoing mail (possibly with a "re:" prefix) is marked as non-spam. Everything else goes in spam, and any spam message from an address I've never received mail from before is marked as unrea…

I'm using something very similar, except incoming messages from never-seen-before senders are greylisted instead: https://en.wikipedia.org/wiki/Greylisting_(email) 95% of spammers never retry.

The problem with greylisting is that it delays subscription confirmation emails when you sign up for a new service. I found that to be more trouble than it was worth. YMMV.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#164
post #156
post #147

I've been running my own spam filter for many years now based on this super-simple heuristic: My filter looks at my outgoing mail, and any mail received from an address I've sent mail to, or with a subject that has appeared in my outgoing mail (possibly with a "re:" prefix) is marked as non-spam. Everything else goes in spam, and any spam message from an address I've never received mail from before is marked as unrea…

Someone posted on X advice that really helped me clean up my inbox Add a filter looking for the word "Unsubscribe" and automatically put them in "Promotional" category or something similar. Also apply the filter to existing emails, and let it run for a minute. Try it now! And comment if it reduced your inbox to like 2% of what it was :)

I tried that a long time ago and the problem with it was that it produced a lot of false positives for me because I subscribe to a lot of Google Groups.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#165
post #156

Earlier quoted context omitted.

Someone posted on X advice that really helped me clean up my inbox Add a filter looking for the word "Unsubscribe" and automatically put them in "Promotional" category or something similar. Also apply the filter to existing emails, and let it run for a minute. Try it now! And comment if it reduced your inbox to like 2% of what it was :)

I've commented here before that it is obvious to me that gmail makes no effort to combat spam anymore given that unsubscribe links are legally required and generally present for spam in the US and are an obvious heuristic that aren't used. I would expect basically any trained filter to pick up on it, so my assumption is that they actually intentionally have rules to allow spam. I get emails that literally say "This i…

A mail service run by an advertising company fails to filter out advertising emails? I'm shocked. Shocked!

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#166

Earlier quoted context omitted.

The problems I noticed were, it doesn't matter what the SPF and DKIM look like. If Google or Microsoft refuse to relay your email based on secret internal factors then you're out of business.

Yes, and they do that routinely.

Same with AWS SES, in my experience.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#167

Earlier quoted context omitted.

Ive got a server hosting a number of things, amd monitoring setup for a lot of stats. Got tired of seeing blips because various countries were beating on my server, not a DoS, but enough requests to notice, and sometimes generate an alert. I blocked 7 countries, in full, and the impact was fantastic. No more 2gb of logs generated every day by countries that have no business accessing my server. Unless you own a globa…

I'm the CTO of a US-based insurance company. Apart from some reinsurers in London and Bermuda, and a couple contractors in Canada, we don't do business outside the US. We've blocked all countries except those, and it has cut down massively on the folks attacking us.

Kinda similar, but when I looked at the finances, I was surprised by how much money we're getting from places like the Cayman Islands, Switzerland, and the Emirates.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#168

Earlier quoted context omitted.

> Russian IP addresses are still trying to send email in the name of my domain for some stupid reason For what it's worth, I've started seeing cybersecurity insurers requiring riders and extra payments if you don't block Russian IPs.

But there are big problems with mapping from IPs to countries. My IPv6 is detected as Russian, though it is London-located tunnel exit point and I'm in the Netherlands.

If it is a tunnel, then it might have been used by someone else before.

Those "London oblast" jokes don't come from nowhere.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#169
post #9
post #3

I am just having this problem. Actually getting SPF, DKIM and DMARC right and having a domain with a 0 spam score will still land you in the spam directory. It turns out, you need to have a "reputation"? before your email gets accepted into gmail. My head was spinning as to how that reputation will be built if your email just goes straight to spam. But sure, Linkedin emails are definitively not spam and their dark-pa…

It's easy, you just have to have a regular, decently sized volume of non-spam emails, and suddenly your email stops being marked as spam! The logic isn't even that bad. SPF and DKIM serve to prove to the email who the sender is. That doesn't mean much if the sender is a spammer. Verifying identity claims is only the first part in checking email for spam, the harder part is checking if that identity is someone you tru…

> you just have to have a regular, decently sized volume of non-spam emails

But if you have a regular decent size of emails coming from your domain, that is more likely to be spam than if you have a small number of intermittent emails coming from a domain.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#170
post #163
post #162

Earlier quoted context omitted.

I'm using something very similar, except incoming messages from never-seen-before senders are greylisted instead: https://en.wikipedia.org/wiki/Greylisting_(email) 95% of spammers never retry.

The problem with greylisting is that it delays subscription confirmation emails when you sign up for a new service. I found that to be more trouble than it was worth. YMMV.

For a greylisting that sends 451 before DATA, that is indeed a known problem.

My server sends 451 after DATA, and keeps a copy of greylisted message, as marked-as-read entry in separate folder. Those are deleted after few hours, or moved out after a successful delivery retry.

Post reply on HN