Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Spammers are better at SPF, DKIM, and DMARC than everyone else

toad.social

Post reply on HN
Print view View original

191–200 of 261 posts

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#191

Post by Aloisius »

blacklion wrote: post #104
JumpCrisscross wrote: post #83

Earlier quoted context omitted.

> Russian IP addresses are still trying to send email in the name of my domain for some stupid reason For what it's worth, I've started seeing cybersecurity insurers requiring riders and extra payments if you don't block Russian IPs.

But there are big problems with mapping from IPs to countries. My IPv6 is detected as Russian, though it is London-located tunnel exit point and I'm in the Netherlands.

If your HE tunnelbroker account's country is set to Russia, you'll show up as from Russia for Google since HE publishes a geofeed of ip range -> user account country for them.[1] You should be able to change it on the settings page.[2]

If that's not it, you an see which database maps your IPv6 range to Russia and contact them to ask them to change it.[3]

Of course, if you have accounts with a Russian addresses, then things will revert.

[1] https://tunnelbroker.net/export/google

[2] https://tunnelbroker.net/account.php

[3] https://www.iplocation.net/ip-lookup

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#192

Post by ahepp »

kmeisthax wrote: post #149
nextn wrote: post #53

Spammers are worse at something no one tried to use AFAIK: require a fee to deliver email.

No, they will happily pay money to spam you. IP reputation, proof-of-work, and various fee-for-receipt schemes are trying to solve spam in the same way: by charging low-volume users a trifle to send messages at a "normal" rate, which adds up to become more expensive when you start bulk mailing. The problem is that these schemes have to assume that there is a single market-clearing price[0] for sending messages that i…

Do you know of any data on this? It seems like the kind of thing that could be studied and measured. I'm inclined to believe the opposite about the viability of e-stamps, but I will readily admit I have no data to back that opinion up.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#193

Post by vel0city »

jeroenhd wrote: post #52
gus_massa wrote: post #48

Earlier quoted context omitted.

With Outlook, in my university the problem was that when we send emails they disappeared mid air, no bounce, no spam folder. The solution was that they must write an email from the Outlook address, after that we are added to a secret good list and we can write them.

I've had to figure out a problem with reaching university Outlook servers where the Outlook server didn't like the (spec compliant) way my email server was writing the From address and rewrote it halfway through the spam filtering chain. Then it checked the DKIM signature on the message it REWROTE ON ITS OWN and decided that the signature didn't match, and rejected my email. Corporate email stacks are hell.

This has almost always been the issue when working with clients on why our emails never appear. In the end they have some weird middleware that rewrites things and then the next level of the stack sees the middleware as the sender of the email for our domain which fails as it's not an approved sender by SPF and dkim signatures don't validate.

A fresh, plain setup on office 365 doesn't fail, but however their security department reconfigured things causes it to fail.

I've never been on the configuration side of M365 email like that, only basic cheap tier stuff and only briefly. I can't say what they're doing, but the same settings sending to practically any other email provider or even other 365 tenants works perfectly fine.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#194

Post by toast0 »

riobard wrote: post #174
toast0 wrote: post #125

Earlier quoted context omitted.

I never found the DMARC reports actionable, so I quickly turned them off. What do you do with the information? Of course, even with hard fail spf and dmarc, I still see some bounces from spam where some server accepted the mail to deliver it elsewhere and the next server denies it, so the first server sends me a bounce.

DMARC reports are for you to be sure that you configured SPF/DKIM correctly, not asking you to do something with the spoofing senders (which you can do absolutely nothing about).

Yeah, so have reports when you start, but once you get things set up correctly, turn off the reports. If you break things later, you should find out quickly when mail is refused, and you can turn on reports again, if you need to.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#195

Post by vel0city »

wizzwizz4 wrote: post #54
jeroenhd wrote: post #52

Earlier quoted context omitted.

I've had to figure out a problem with reaching university Outlook servers where the Outlook server didn't like the (spec compliant) way my email server was writing the From address and rewrote it halfway through the spam filtering chain. Then it checked the DKIM signature on the message it REWROTE ON ITS OWN and decided that the signature didn't match, and rejected my email. Corporate email stacks are hell.

Do you have a write-up of this, anywhere? I'd appreciate the details (what format did it reject? what did it change it to? what version of Exchange?).

Not OP but I've also seen this. I think some of the servers in question were "outlook-protection" in their domain names. Some kind of managed service middleware in the stack to do additional scanning.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#196

Post by EGreg »

lisper wrote: post #164
EGreg wrote: post #156

Earlier quoted context omitted.

Someone posted on X advice that really helped me clean up my inbox Add a filter looking for the word "Unsubscribe" and automatically put them in "Promotional" category or something similar. Also apply the filter to existing emails, and let it run for a minute. Try it now! And comment if it reduced your inbox to like 2% of what it was :)

I tried that a long time ago and the problem with it was that it produced a lot of false positives for me because I subscribe to a lot of Google Groups.

Can you make a negative condition also, X but not Y?

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#197

Post by ahepp »

I have a much bigger issue with "legitimate" spam these days. Every service makes you give an email address, and they all force you to check a box allowing them to email you whatever they want. Then if they even have an "opt out" link, it takes you to a list of 500 different types of notifications and forces you to opt out of each one individually.

Usually I will just disable the iCloud hide-my-email I used for a site, but sometimes there are legitimate emails mixed in with the stream of crap. I opted out of marketing emails from my credit card company, and now they instead send me emails asking me to re-evaluate my email preferences...

It would be nice to see more done to fix this, but I guess it doesn't make anyone money. I guess I'll just have to use AI to filter signal from noise.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#198

Post by vel0city »

Gigachad wrote: post #27
csomar wrote: post #3

I am just having this problem. Actually getting SPF, DKIM and DMARC right and having a domain with a 0 spam score will still land you in the spam directory. It turns out, you need to have a "reputation"? before your email gets accepted into gmail. My head was spinning as to how that reputation will be built if your email just goes straight to spam. But sure, Linkedin emails are definitively not spam and their dark-pa…

I think the domain rep is worth less than IP rep. I had occasional issues sending issues when I self hosted on a VPS. When I moved my domain to Fastmail I haven’t ever had my emails go to spam. Most home and VPS IP ranges have negative rep.

As a tip, go to a VPS that's had a history of being very selective of allowing SMTP traffic but still allows after some kind of review. Cheap providers that never did any blocking probably have bad reputations for their entire address range.

I've been successfully using VPSes to send emails for 20 years.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#199

Post by rchaud »

throw0101c wrote: post #79
chillfox wrote: post #22

Earlier quoted context omitted.

In most organizations there is no point in a sysadmin to spend the effort in understanding how to set it up correctly as Marketing has got more authority on email. Marketing will simply demand changes to the config that they do not understand and there is nothing you can do to stop it as they will have the CEO on their side.

> Marketing will simply demand changes to the config that they do not understand and there is nothing you can do to stop it as they will have the CEO on their side. Marketing should get their own (sub)domain for sending their missives, that way the primary corporate domain's reputation is not harmed. Unless you want to run the risk of outgoing e-mails from Finance / Accounts Receivable to be sent to other companies'…

This is email marketing 101, HN'ers are massively overstating how many domains are getting blacklisted because of "marketing".

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#200

Post by nextn »

kmeisthax wrote: post #149
nextn wrote: post #53

Spammers are worse at something no one tried to use AFAIK: require a fee to deliver email.

No, they will happily pay money to spam you. IP reputation, proof-of-work, and various fee-for-receipt schemes are trying to solve spam in the same way: by charging low-volume users a trifle to send messages at a "normal" rate, which adds up to become more expensive when you start bulk mailing. The problem is that these schemes have to assume that there is a single market-clearing price[0] for sending messages that i…

Sorry, I didn't clarify something.

Require a fee to deliver email. If the email is deemed legitimate by the recipient then refund the fee.

> No, they will happily pay money to spam you

It's a question of price. They can't spam at scale at high enough price.

Post reply on HN