Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DMARC has been public since 2012 but most company domains still don't enforce it

ciphercue.com

Post reply on HN
Print view View original

161–170 of 185 posts

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#161

Post by Freebytes »

EvanAnderson wrote: post #21

I mind email for a number of small orgs (<1000 recipients each). There are so many SPF and DKIM failures from senders who you'd think would know better (Fortune 100-type companies). I don't want complaints from users missing messages so I end up disregarding failures even when published policy says to do otherwise.

The real reason p=none persists is because people would rather err on the side of email being delivered that is actually junk than having a miss of legitimate mail. (This also the reason for so many soft failure entries in SPF records.)

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#162

Post by Freebytes »

jwr wrote: post #9

I really think we should be solving a much bigger problem of the major email providers not providing an automated way of handling abuse and not caring about abuse reports at all. Most of my spam comes from the three major email providers and at this point I gave up even trying to send abuse reports because they just get ignored. The big companies do not have to care because nobody will block Google, Microsoft or Amaz…

Not to mention that the larger companies are incentivized not to deliver your email due to low volume. If your service does not work, companies will be encouraged to use Google or Microsoft instead.

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#163

Post by Freebytes »

talkingtab wrote: post #106
baron3dl wrote: post #19

Earlier quoted context omitted.

You can do this right now, and you don't even need to fork anything. E-mail is an internet scale protocol that's not owned or ownable, except by convention. Since you specifically want to cut out Google, and their attempts to capture E-mail are what makes rolling your own E-mail hard anyway, just go for it. Depending on how hard you want to make it, you can slap all the parts together yourself or use something like Z…

What I am proposing is that community email servers can talk to each other. I have email servers setup - all the hoops - for my community. I want others to set up community servers and be able to interoperate. My server can send and receive from other communities. No corporations, no tracking. If your sever spams it gets dropped from the federation. Yes it is more complex, and there will be problems and issues. But h…

You are thinking of approved domains only, and perhaps people can vote them out. But, what you are describing is an RBL (in this case a real time whitelist instead). I like the ability for existing members to be able to vote out other members, but you run into the issue of spammers creating a million domains and then being able to vote out all legitimate members.

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#164

Post by cookiengineer »

Geezus_42 wrote: post #132
cookiengineer wrote: post #39

Earlier quoted context omitted.

^ this Additionally, I would probably guess correctly that almost all spam comes from rotating ASNs these days. Aka from companies that do "growth marketing" or other bullshit that isn't a valid business but just... spamming people. A lot of the domains that fall through the cracks for single-spam-campaigns have been taken over by botnet campaigns, so the actual owners of said domains probably don't know that their w…

Why would you care about TLS for spam? Are you proposing that any email sent without TLS should be label spam?

The cheaper the relay mechanism is, the more noise/spam you'll get.

Lots of servers online have a publicly exposed smtp port, where all kinds of script kiddies are just using a sendmail style email from another (not-owned) domain.

DKIM/DMARC tried to fix this (without success due to fakeable entries in the DNS records, spf=all is pretty much everywhere anyways nowadays). So my proposal for actual ownership of domain AND server infrastructure would be mutual TLS. Reverse IP lookups are broken almost always anyways, due to most hosting providers not offering real reverse DNS infrastructure that users can modify.

This way a compromised server can't send as another domain, and large-scale spamming relays that rotate ASNs would have indicators in the cert itself, which they run out of real quick due to limitations of how many IP/DNS subjects you can set in an SSL/TLS cert.

No faking and avoiding bad IP reputations by rotating ASNs anymore.

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#165

Post by CSSer »

Freebytes wrote: post #161
EvanAnderson wrote: post #21

I mind email for a number of small orgs (<1000 recipients each). There are so many SPF and DKIM failures from senders who you'd think would know better (Fortune 100-type companies). I don't want complaints from users missing messages so I end up disregarding failures even when published policy says to do otherwise.

The real reason p=none persists is because people would rather err on the side of email being delivered that is actually junk than having a miss of legitimate mail. (This also the reason for so many soft failure entries in SPF records.)

This is true. Here’s a cautionary tale to that end. My org’s IT recently introduced, without input, an ai filtering tool to automatically filter junk email. It apparently worked too well. In an ironic twist of fate, it filtered a raft of emails (across multiple domains, including tickets and account reps!) to IT from an important vendor about contract renewal into junk that ultimately resulted in leaving the vendor no choice but to suspend service until the bill was paid (they waited until the very large bill was over two months past due to do this, to their credit).

When I learned about this during the post-mortem I was incensed, to say the least. Email mgmt is part of a professional’s job, for better or worse. Accountability for that doesn’t suddenly evaporate because of a scenario like this. I don’t practice zero inbox for fun. I do it for my sanity and effectiveness. Technology can’t magically solve every problem.

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#166

Post by Freebytes »

dmurray wrote: post #69
thesuitonym wrote: post #35

Earlier quoted context omitted.

You can already do this without changing anything. Just set your corporate mailserver to not accept mail from common community email providers. There's a reason nobody does this, and it's because it's a bad idea. There is so much crossover between personal email and corporate email.

My previous employer did this, and no one seemed to miss it. If you had a use case to add an exception (the most common was to send yourself a mail from your personal Gmail, to print something on the corporate printers) that was supported and straightforward too.

One solution would be whitelist only. You must specifically whitelist a domain or email address, and everything else is blocked. If someone wants to send you an email, you must get their email address.

However, if you are using it to sign up for a service online, the domain often does not match the sender. You might sign up at the example.com website, but you get an email from noreply@auth-example.com as the email address.

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#167

Post by Freebytes »

vandyswa wrote: post #30

DMARC, just like SPF before it, solves nothing. The spammers adapt. And unlike SPF, DMARC has an enormous technology surface area. Its failure modes are legion, and each one is tedious to run down to resolution. Which just returns you to something which never pays the rent anyway.

SPF did solve an issue. Domain impersonation is no longer as much of an issue if you are strict against SPF failures. DMARC, on the other hand, solved absolutely nothing.

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#168

Post by Freebytes »

smartmic wrote: post #2

I am self-hosting my (secondary) email and have only implemented SPF and DKIM. This works fine on a practical level for me. What would be the benefit of setting up DMARC on top?

Some large companies have started blocking domains that do not have DMARC. It is a simple DNS entry. (Easier than SPF.) You should add it to all of your domains even though it accomplishes very little other than meeting the requirements of some larger companies.

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#169

Post by EvanAnderson »

Freebytes wrote: post #161
EvanAnderson wrote: post #21

I mind email for a number of small orgs (<1000 recipients each). There are so many SPF and DKIM failures from senders who you'd think would know better (Fortune 100-type companies). I don't want complaints from users missing messages so I end up disregarding failures even when published policy says to do otherwise.

The real reason p=none persists is because people would rather err on the side of email being delivered that is actually junk than having a miss of legitimate mail. (This also the reason for so many soft failure entries in SPF records.)

I don't mind p=none. I'm more bent out of shape about policies that tell me to reject that, if followed, would result in the loss of legit email.

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#170

Post by Freebytes »

account42 wrote: post #72
cube00 wrote: post #24

Earlier quoted context omitted.

> What would be the benefit of setting up DMARC on top? Some mail providers will junk your mail if you don't have a reject/quarantine DMARC policy because you're seen as enabling the spammers so everything out of your domain must be punished.

[citation needed]

https://powerdmarc.com/gmail-enforcement-email-rejection/
Post reply on HN