171–180 of 185 posts
Sadly the article doesn't really touch on whether or not DMARC accomplishes anything truly useful. When I enabled DMARC for ingress email on one of my own mail servers, it ultimately ended up regularly blocking a handful emails from customers, yet virtually all the spam coming in had valid SPF / DKIM / DMARC, as do most of the phishing attacks. The core problem is that the real need of email end users need is a way o…
Earlier quoted context omitted.
Sue the spammer, getting a subpoena from Google to find their identity.
That surely is a sustainable and cost-effective alternative to Google using their trillions of dollars in resources to behave responsibly.
Earlier quoted context omitted.
Yes. If an email comes from alice@gmail and validates to gmail, alice sent it. It's possible that gmail screwed up and gave Bob access to Alice's account. In this situation, though, Alice still sent it.
Google is not the only email provider in the world, though. Not all email services are global corporations, and we must be careful never to interrupt the services of independent email providers.
Earlier quoted context omitted.
What spammers are using the same domain for longer than couple of hours? What do you expect to achieve by blocking an already abandoned domain?
@gmail.com and @outlook.com are like 90% of the spam I receive. What’s missing is effective accountability for those two companies hosting persistent spam groups who operate for months unimpeded.
So wait, it seems like you're claiming that you're receiving spam from the same gmail/outlook address for months.
This is fascinating and I have a hard time believing it, might you be able to share some headers?
OTOH, if the spammers are forced to frequently switch accounts, they're clearly being impeded.
Earlier quoted context omitted.
I don't get it. Neither one is hard to setup. How do people have such a hard time with such simple configuration. Then again the majority of "mail admins" I have interacted with have absolutely no understanding of SMTP and can barely wrap their heads around DNS. I've had more than one argue with me that having more than 10 lookups in the SPF isn't the issue even though I am showing them the SPF failure and the RFC st…
DKIM is hard to set up. SPF is easy.
Earlier quoted context omitted.
Why would you care about TLS for spam? Are you proposing that any email sent without TLS should be label spam?
The cheaper the relay mechanism is, the more noise/spam you'll get. Lots of servers online have a publicly exposed smtp port, where all kinds of script kiddies are just using a sendmail style email from another (not-owned) domain. DKIM/DMARC tried to fix this (without success due to fakeable entries in the DNS records, spf=all is pretty much everywhere anyways nowadays). So my proposal for actual ownership of domain…
Sadly the article doesn't really touch on whether or not DMARC accomplishes anything truly useful. When I enabled DMARC for ingress email on one of my own mail servers, it ultimately ended up regularly blocking a handful emails from customers, yet virtually all the spam coming in had valid SPF / DKIM / DMARC, as do most of the phishing attacks. The core problem is that the real need of email end users need is a way o…
> virtually all the spam coming in had valid SPF / DKIM / DMARC, as do most of the phishing attacks. This should create a means to go after the domain owners via registrar and trail of ownership, even so far as blocking email from the domain. Forcing the spammers to pass DMARC creates a burden and an evidence trail that didn't exist before.