Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Learn and Test DMARC

learndmarc.com

Post reply on HN
Print view View original

41–50 of 65 posts

Re: Learn and Test DMARC

#41

Post by jeroenhd »

anamexis wrote: post #29
jauntywundrkind wrote: post #13

Earlier quoted context omitted.

You sent an email without a "from" field and it broke. Programmer didn't think to test for bad users doing bad things. Nothing special here, no big conspiracy.

It's not a "bad user doing bad things," it's a widely-used email forwarding service.

If this is true and Apple's service does leave out a "from" header (it may just as well be a parse error somewhere on the website's side) that would definitely be on the mail forwarding service, not on this particular website.

RFC 5322 and RFC 2822 specify that at least and at most one From: header must be present. Mail services that don't add at least some kind of fake From header aren't spec compliant and should probably expect error and delivery problems. RFC 2822 is over 20 years old now.

In theory Apple's service could only be RFC 822 compliant, but this does pose a big interoperability problem for its customers.

Re: Learn and Test DMARC

#43

Post by emaildelivboy »

DMARC is and has always been...fine, save for the fact that most phishing / exploits are sent using cousin domains. Is a DMARC policy necessary and a great security measure? Sure. Is it a domain identity security game changer?... no way.

Re: Learn and Test DMARC

#44

Post by emaildelivboy »

systems_glitch wrote: post #28
amelius wrote: post #22

This is how email is supposed to work. In reality, there are whitelists ...

And blacklists. And predatory blacklists. And blacklists that amount to organized extortion.

Hello UCEPROTECT. The only blocklist that matters is SPAMHAUS. Other blocklists at the inbox provider level are behind the curtain.

Re: Learn and Test DMARC

#45

Post by Rookie42 »

jeroenhd wrote: post #40
Rookie42 wrote: post #31

Great way of pushing the critical email services we all need to reduce spam. While I have always wanted SPF, DKIM and DMARC to be enough of an incentive for the businesses i work with, reputation is often not enough of a driver to prioritise the investment. But fret not! For when you are dealing with companies which want to communicate with customers in a trusted way, there is a marketer's dream standard - Brand Indi…

DMARC still has some issues. From a few years ago: https://i.blackhat.com/USA-20/Thursday/us-20-Chen-You-Have-N... > Unfortunately, neither SPF nor DKIM provides a complete solution for preventing email spoofing. SPF authenticates the HELO/MAIL FROM identifier and DKIM authenticates the d= field in DKIM-signature header: neither of them authenticates the From header displayed to the end-user, which means that even if…

It inst perfect, but it doesn't need to be unless your risk is disproportional to the market. Risk will always be there, you just need to manage it inline with your corporate risk tolerance - and implementing DMARC to P=Reject is most likely going to (very likely exceed) that approach.

Yes, some companies have elevated risk here (Banks, Payment Processors, Social Media companies) - but honestly most don't.

Btw - this is as much an acceptance as a survival strategy - nothing will ever be perfect, not without significant cost & impact elsewhere. Survival of the fittest these days is managing (and please the understanding of) risk better than others

Re: Learn and Test DMARC

#46

Post by ttul »

pests wrote: post #33
ttul wrote: post #32

Earlier quoted context omitted.

Appreciate the skepticism; it keeps us on our toes. Let's cut to the chase: Domain Lockdown: We added this to our Cloudflare Workers integration. It mandates a DNS TXT record to authorize a Worker to send emails from a specific domain. You can't forge the CF-Worker header, so impersonation is off the table. Pre-Lockdown Vulnerability: Yes, we were more exposed before. Thanks to the researchers who pointed it out, we'…

Thank you for the transparency and the update. I didn't mean anything negative towards MailChannels - I know this is a weak link in the chain for many people. I did know it was resolved and I should have mentioned that but I couldn't figure out the search query to find that post.

No worries. My initial response was horrible; trying to do better.

Re: Learn and Test DMARC

#47

Post by sgt »

amelius wrote: post #22

This is how email is supposed to work. In reality, there are whitelists ...

Whitelists for what? Having a pre-determined whitelist for domains allowed to send to your domain is not common. That would defeat the purpose of e-mail.

Re: Learn and Test DMARC

#48

Post by blitzar »

emaildelivboy wrote: post #43

DMARC is and has always been...fine, save for the fact that most phishing / exploits are sent using cousin domains. Is a DMARC policy necessary and a great security measure? Sure. Is it a domain identity security game changer?... no way.

Is a DMARC policy necessary and a great security measure to stop most phishing / exploits being sent using your cousin domains ...

Re: Learn and Test DMARC

#49

Post by freddieleeman »

guessmyname wrote: post #7

I sent an email via Apple’s “Hide My Email” service [1]. > Unhandled Promise Rejection: > TypeError: a.from.replace(/[ > dist.min.js:3:32767 This error occurred after the interface began displaying the following information: > Here are the message headers and message body: > DKIM-Signature: d=icloud.com s=1a1hai It’s been over a year since the website was featured on Hacker News (January 10, 2022), so I suspect that…

As DMARC relies on the RFC5322.From address, omitting it will lead to errors. To avoid these errors, emails lacking this address are currently being ignored.

Re: Learn and Test DMARC

#50

Post by RektBoy »

People, don't forget to properly set all these checks for DNS failover.

I saw companies got scammed, because they used default settings in Exchange Online.

And attacker just made the DNS "unavailable" for brief moment and all phishing emails passed. Because MS server responded with DNS "temp error" and pass all emails as not a spam. (detailed: received-spf: TempError (protection.outlook.com: error in processing during lookup of : DNS Timeout) and DKIM is checked on domain of sender's SMTP server, in this case attacker's server used for phishing )

Then I had the great experience with MS IT/security support, people there can't even understand how emails works, very funny and sad experience. I hope outsourcing works for them.

Post reply on HN