Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DMARC has been public since 2012 but most company domains still don't enforce it

ciphercue.com

Post reply on HN
Print view View original

181–185 of 185 posts

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#181

Post by snapplebobapple »

bcrl wrote: post #97
WorldMaker wrote: post #90

Earlier quoted context omitted.

Can we use DMARC to ask Gmail to close registrations? Google Calendar to allow far fewer people the ability to send invite notifications? Firebase to close registrations? Azure? Microsoft 365? AWS SES? It feels like the biggest spammers have swung back to just abusing SaaS and getting SPF / DKIM / DMARC for free from one of the big email providers.

Exactly this. Spammers have the technical competence to overcome any technical hurdle, so using evidence of technical competence achieves nothing. If it were possible to charge $0.25/email for delivery, I'd be more than happy . However, I'm sure large tech firms will need to say that is "too hard to implement at scale".

You actually shouldnt makebit 25 cents to send, just make it so you need to deposit 25 cents for every mail you want to send for a 7 day period and make it trivially easy for me as the recipient to cause ypu to lose that deposit in the 7 days. For example embed a url in the email that i can click to open a webpage that asks me if the email is legit or not with a big red no button and a big green yes button. Money doesnt even have to flow to me. The whole thing could be a non profit that invests the forfitted money in medical research or saving puppies or something else suitably unoffensive.

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#182

Post by Geezus_42 »

inigyou wrote: post #179
Geezus_42 wrote: post #177

Earlier quoted context omitted.

No it's not. You just publish another TXT record.

...... and sign all outgoing emails.

Which is not hard to do. It's literally a switch in O365. It takes a bit more in other environments, but nothing a competent admin should really struggle with.

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#183

Post by cookiengineer »

Geezus_42 wrote: post #178
cookiengineer wrote: post #164

Earlier quoted context omitted.

The cheaper the relay mechanism is, the more noise/spam you'll get. Lots of servers online have a publicly exposed smtp port, where all kinds of script kiddies are just using a sendmail style email from another (not-owned) domain. DKIM/DMARC tried to fix this (without success due to fakeable entries in the DNS records, spf=all is pretty much everywhere anyways nowadays). So my proposal for actual ownership of domain…

I don't think you understand how TLS or SMTP work. You can easily send a message via TLS through and open relay. Only accepting TLS would do nothing because most spam and phishing emails are already delivered via TLS.

I was talking about _mutual_ TLS.

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#184

Post by inigyou »

Geezus_42 wrote: post #182
inigyou wrote: post #179

Earlier quoted context omitted.

...... and sign all outgoing emails.

Which is not hard to do. It's literally a switch in O365. It takes a bit more in other environments, but nothing a competent admin should really struggle with.

so your opinion is that anyone who self-hosts their email is not competent? You know, there's a huge amount of machinery behind that toggle switch Microsoft offers you.

Re: DMARC has been public since 2012 but most company domains still don't enforce it

#185

Post by Geezus_42 »

inigyou wrote: post #184
Geezus_42 wrote: post #182

Earlier quoted context omitted.

Which is not hard to do. It's literally a switch in O365. It takes a bit more in other environments, but nothing a competent admin should really struggle with.

so your opinion is that anyone who self-hosts their email is not competent? You know, there's a huge amount of machinery behind that toggle switch Microsoft offers you.

No. I think that people who can't figure out how to install openDKIM and connect it to Postfix are not competent email admins.
Post reply on HN