Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

Post by yencabulator » Fri, Jan 12, 2024, 12:22 AM UTC

boplicity wrote: post #170

ryandrake wrote: post #12

As a self-hoster for over a decade, setting up SPF, DKIM, and DMARC are pretty much once-and-done and free, so there's pretty much no downside. I'd be shocked if most self-hosters haven't set these up long ago.

For those sending in bulk, the more challenging part will be complying with rfc8058 https://datatracker.ietf.org/doc/html/rfc8058

    List-Unsubscribe-Post: List-Unsubscribe=One-Click

Post by jcrites » Fri, Jan 12, 2024, 8:56 PM UTC

JimDabell wrote: post #114

jcrites wrote: post #106

Earlier quoted context omitted.

That could potentially cause them problems, yeah, if you were able to do that endlessly. In practice most companies will have some kind of rate limiting in place around features like that (by IP, cookie, captcha, etc.)

IP and cookie-based rate-limiting are trivially bypassed. In fact, any kind of rate-limiting is ineffective here, especially for smaller organisations, because you only need to generate a small fraction of the traffic they normally send out. If they separate transactional mail from other types of mail (something that is frequently recommended), then how many illegitimate password reset emails do you think an attacker…

Post by SpaghettiCthulu » Mon, Jan 15, 2024, 1:57 AM UTC

kragen wrote: post #266

rstuart4133 wrote: post #255

Earlier quoted context omitted.

> it means that if you forward an email list message to someone else, they can unsubscribe you without your consent as a prank Surely that is a bug in the email client that forwarded the email. It should have replaced the headers, including List-Unsubscribe, with its own. That looks to be what's happened in the emails I receive. The one exception would be if someone forwarded an email as an attachment, but in practic…

what does your user interface for interacting with the list-unsubscribe header look like?

Post by freddieleeman » Mon, Jan 15, 2024, 8:53 AM UTC

flumpcakes wrote: post #175

freddieleeman wrote: post #93

For those interested in testing their email for SPF, DKIM, and DMARC compliance or eager to learn about these mechanisms that enhance email security and prevent spoofing, check out https://learnDMARC.com . This is a site I developed to promote adoption and share knowledge. It includes a challenging quiz, tough even for professionals. I'd be keen to know your scores on the first attempt – honesty counts!

This is great! I scored 60% because I didn't realise 5321 HELO was also checked. That's news to me, I've never seen that before. I got 90% on my 2nd attempt :) Also I think there was one question that was a mistake, it had a policy along the lines of: v=DMARC1; p=reject; ; pct=0; I answered that a failing message would have an effect of p=none, but the right answer was apparently p=quarantine. Is that right, consider…

Post by Breza » Fri, Jan 19, 2024, 12:24 PM UTC

renewiltord wrote: post #181

JimDabell wrote: post #101

Earlier quoted context omitted.

> If you’re sending transactional emails like password resets or MFA, then the emails will have close to a 100% open rate. So I can disable a competitor’s email functionality by triggering a whole bunch of password reset requests for all discoverable usernames?

If they support SMS 2FA they need to be prepared for this too because it costs a lot. Yeah, so people need to ensure that reset is at least a little hard to abuse. After all, it's a bad experience for their users if they receive a shit ton of reset emails anyway.