I use NameCheap for domain registration, web hosting, and email.
Unless I pay extra for Premium DNS, my DKIM is set wrong because their Web Hosting DNS does not oet me set it correctly.
Spammers are better at SPF, DKIM, and DMARC than everyone else
211–220 of 261 posts
Re: Spammers are better at SPF, DKIM, and DMARC than everyone else
#212Earlier quoted context omitted.
Ive got a server hosting a number of things, amd monitoring setup for a lot of stats. Got tired of seeing blips because various countries were beating on my server, not a DoS, but enough requests to notice, and sometimes generate an alert. I blocked 7 countries, in full, and the impact was fantastic. No more 2gb of logs generated every day by countries that have no business accessing my server. Unless you own a globa…
> I blocked 7 countries Russia, China, Nigeria, Romania, North Korea, Iran and Belarus [1]? [1] https://www.ox.ac.uk/news/2024-04-10-world-first-cybercrime-...
Pretty close tbh. Sub romania for brazil, and nigeria, for... i dont remember right now
Re: Spammers are better at SPF, DKIM, and DMARC than everyone else
#213Earlier quoted context omitted.
I've commented here before that it is obvious to me that gmail makes no effort to combat spam anymore given that unsubscribe links are legally required and generally present for spam in the US and are an obvious heuristic that aren't used. I would expect basically any trained filter to pick up on it, so my assumption is that they actually intentionally have rules to allow spam. I get emails that literally say "This i…
An advertisement is only spam if it's unsolicited. If you forget to uncheck the box "yes send me promotional offers and deals" when signing up it's not spam according to that definition.
If you're making people opt-out and setting them up to "forget" to do so, then you are spamming them, but even under that definition, I'd estimate that over 99% of what I'm calling spam still qualifies. A large amount of it is from businesses I've never interacted with, so obviously unsolicited.
Re: Spammers are better at SPF, DKIM, and DMARC than everyone else
#214Earlier quoted context omitted.
The problems I noticed were, it doesn't matter what the SPF and DKIM look like. If Google or Microsoft refuse to relay your email based on secret internal factors then you're out of business.
This attitude is just FUD. The issue here generally boils down to the defining difference between a generalist Admin and a Messaging Admin. The generalist can follow instructions, and nearly all the instructions out there stop at the point where SPF/DKIM/DMARC are successfully implemented. A generalist worth their salt will then fill in the gaps if they can', and knows this isn't where you stop when you want mail del…
MS flat out refuses to unblock our IP on their "outlook protection" racket despite many attempts through their self-service website.
Our IP is the same for the last ... ~5 years now? Is it because we did not buy a /24? is it because we are so small they have no real reputation data? who knows!
Re: Spammers are better at SPF, DKIM, and DMARC than everyone else
#215I am just having this problem. Actually getting SPF, DKIM and DMARC right and having a domain with a 0 spam score will still land you in the spam directory. It turns out, you need to have a "reputation"? before your email gets accepted into gmail. My head was spinning as to how that reputation will be built if your email just goes straight to spam. But sure, Linkedin emails are definitively not spam and their dark-pa…
It's easy, you just have to have a regular, decently sized volume of non-spam emails, and suddenly your email stops being marked as spam! The logic isn't even that bad. SPF and DKIM serve to prove to the email who the sender is. That doesn't mean much if the sender is a spammer. Verifying identity claims is only the first part in checking email for spam, the harder part is checking if that identity is someone you tru…
so my personal domain just needs to send newsletters to millions of people, or ... how exactly? what's decent size? how frequently?
Re: Spammers are better at SPF, DKIM, and DMARC than everyone else
#216[dead]
Re: Spammers are better at SPF, DKIM, and DMARC than everyone else
#217Earlier quoted context omitted.
This attitude is just FUD. The issue here generally boils down to the defining difference between a generalist Admin and a Messaging Admin. The generalist can follow instructions, and nearly all the instructions out there stop at the point where SPF/DKIM/DMARC are successfully implemented. A generalist worth their salt will then fill in the gaps if they can', and knows this isn't where you stop when you want mail del…
MS flat out refuses to unblock our IP on their "outlook protection" racket despite many attempts through their self-service website. Our IP is the same for the last ... ~5 years now? Is it because we did not buy a /24? is it because we are so small they have no real reputation data? who knows!
In my experience, MS and others give you a chance to correct the issue and if you don't do so in a timely manner (which requires qualified help), or it isn't corrected, then you get blackholed thereafter, and will remain that way up to years afterwards.
There is very little interaction from them, they assume you'll be professional enough to read the published literature and act accordingly.
The literature is a way of adding cost to those that would send spam, it also adds cost in other ways.
If I had to guess without knowing more, assuming you've correctly configured yourself locally (which may not actually be the case), I'd say it could be because of your ISP.
In recent years, with the depletion and exhaustion of IPv4 address space, many ISPs have moved towards CGNAT, where multiple customers share the same IP transparently. The ISP may do this without you knowing, but you'd have to have constructive knowledge in some fine print.
Subsequently by extension, they share the same reputation characteristics for that portion as others on the same network. Residential IP blocks get heavily punished or outright blocked on both sides.
There isn't this problem with IPv6 (no CGNAT and its complications).
I've seen this a few times now; even when the business purchased the business tier service for a static IP. In the client's case there was fine print that mattered that they didn't read in their service/purchase agreement.
The telltale sign that this might be your problem usually requires discussions with your ISP, but if you can't get to a qualified person on the line (from the backend/T2 team) you can run a test.
Have your networking guys check the traffic outbound and inbound (from public facing node) with a connection/packets that uses decrementing TTLs with either ICMP or TCP packets to get a path that aggregates each hop. Tracert or equivalent.
See if it is appearing to be routed through bogon network address space before it hits the wider network.
There are reserved addressing for CGNAT, and if the traffic is being routed across those address ranges this may be a large portion of your problem. This is just one of many things someone that specializes in messaging knows a thing or two about.
Graduated vendor responses occur with messaging, when you have little sound reputation at the start, getting everything right matters. Commercial places warm their domains and IP addresses up slowly over the span of a month. If you send to a provider like gmail, you need to click open those emails as mail that never gets read affects reputation per the whitepaper (m3aawg).
If you don't follow the practices the industry publishes, they don't relay the traffic.
> who knows!
I should know because I've worked in this area for quite a long time. It really is not black magick, and it is a specialized niche for a reason.
Re: Spammers are better at SPF, DKIM, and DMARC than everyone else
#218Earlier quoted context omitted.
As a non-email guy, I can tell you that if a system that boils down to having an (optionally certified?) key requires much more than just putting it into a folder with a domain name and running a service, it’s badly designed and has unnecessary complexity. Which will result into abusers having more expertise than legitimate users. The fact that you can “get” DMARC SPF DKIM wrong, while it’s basically a hard requireme…
As a generalist admin, would you say the same about DBA operations or would you say that's just not my specialty? The reasoning you provide doesn't differentiate, and speaks more of frustration which naturally comes with any area you aren't steeped in, or knowledgeable about.
Frustration doesn't come naturally. It comes with shitty software design.
"I don't know" is not a problem, you learn and you know, no frustration.
The problem is "I spent N hours/days on a thing that everyone does and which is a 99.99% of use cases and boils down to just having a keyfile in a proper(?) location and this knowledge doesn't translate effing nowhere".
would you say the same about DBA operations or would you say that's just not my specialty
It depends on the absurdity of the complexity of setting something up, not on operations themselves. Getting some results is absurdly complex -- not naturally complex and not necessarily very complex, just much more complex than the nature of the result itself.
For example, that's how you were supposed to install openvpn before angristan scripts: https://www.digitalocean.com/community/tutorials/how-to-set-... . To save someone a click, it's 50 pages "installation tutorial" with around 50 commands and a dozen of config files. And guess what, it uses "easyrsa" package to "set up RSA PKI easily". So it's not how openvpn meant to be installed, but an "easy" way.
Re: Spammers are better at SPF, DKIM, and DMARC than everyone else
#219For me, as someone with their own mail server, these technologies mostly serve to inform me that Russian IP addresses are still trying to send email in the name of my domain for some stupid reason. It makes sense that people whose business is sending email know how to set up email correctly. I'm mostly surprised at how many legitimate sysadmins struggle with getting the basics correct. Surely those dozens of DMARC em…
> Russian IP addresses are still trying to send email in the name of my domain for some stupid reason For what it's worth, I've started seeing cybersecurity insurers requiring riders and extra payments if you don't block Russian IPs.
Ok but you can’t block someone else using their own IPs to send email.
If you set DMARC to report, you’ll get notices from remote email systems when they receive noncompliant emails with your domain in the Envelope From field. Those reports are where you’ll see Russian IP addresses show up when they are trying to spoof your emails.
But there is no way to block them because neither the senders nor receivers are on your infrastructure. The best you can do is set a reject DMARC policy and hope everyone follows it.
Re: Spammers are better at SPF, DKIM, and DMARC than everyone else
#220Earlier quoted context omitted.
An advertisement is only spam if it's unsolicited. If you forget to uncheck the box "yes send me promotional offers and deals" when signing up it's not spam according to that definition.
If you're making people opt-out and setting them up to "forget" to do so, then you are spamming them, but even under that definition, I'd estimate that over 99% of what I'm calling spam still qualifies. A large amount of it is from businesses I've never interacted with, so obviously unsolicited.
Isnt it against GDPR and they could get hit with large fines in Europe for every recipient?