Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Spammers are better at SPF, DKIM, and DMARC than everyone else

toad.social

Post reply on HN
Print view View original

71–80 of 261 posts

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#71

Post by ipaddr »

tigeroil wrote: post #32
chillfox wrote: post #22

Earlier quoted context omitted.

In most organizations there is no point in a sysadmin to spend the effort in understanding how to set it up correctly as Marketing has got more authority on email. Marketing will simply demand changes to the config that they do not understand and there is nothing you can do to stop it as they will have the CEO on their side.

You mean like the time I had a salesperson demanding that we turn off Cloudflare across our entire domain because he'd read some random article somewhere saying we should?

The goal of sales isn't to block upto a 1/3 of world wide traffic. Turning off Cloudfare means more traffic and more sales are not blocked. Did you even read the article or did you dismiss it because it came from 'sales'.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#72

Post by MisterTea »

upofadown wrote: post #34

SPF/DKIM is really about mail server reputation. So it mostly benefits larger servers like the ones run by Google, Microsoft and Yahoo. Unfortunately, that means that attempts by those larger providers to combat spam using such reputation will naturally hurt smaller providers. So the actual effects of SPF/DKIM are on the whole negative. The root problem is that we don't actually need to keep track of email server rep…

> Unfortunately, that means that attempts by those larger providers to combat spam using such reputation will naturally hurt smaller providers.

Indeed. I am on a few mailing lists and many people on them host their own email. I use Gmail so that means visiting my spam inbox once a day to click "not spam" upward of a few dozen times. Day in and day out, same people end up in Googles spam folder. It's bullying and sabotage.

> No one says to themselves "Huh, this is from a Gmail address, it must be legit".

Indeed. I get a shit load of spam from google addresses so reputation is not there.

> We really want to keep track of sender reputation.

This is the hard part but I do think it's something to think about. I should be able to get an email from a known sender every time without $emailprovider making that decision for me. Some sort of attached signature or key that is proof of sender identity so I can route that right into my inbox.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#73

Post by arccy »

jasode wrote: post #42
upofadown wrote: post #34

SPF/DKIM is really about mail server reputation. So it mostly benefits larger servers like the ones run by Google, Microsoft and Yahoo. Unfortunately, that means that attempts by those larger providers to combat spam using such reputation will naturally hurt smaller providers. So the actual effects of SPF/DKIM are on the whole negative. The root problem is that we don't actually need to keep track of email server rep…

>SPF/DKIM is really about mail server reputation. So it mostly benefits larger servers like the ones run by Google, Microsoft and Yahoo. Unfortunately, that means that attempts by those larger providers to combat span using such reputation will naturally hurt smaller providers. So the actual effects of SPF/DKIM are on the whole negative. That paragraph is incorrect. SPF/DKIM is not about reputation. The main purpose…

preventing impersonation is an important part on correctly attributing reputation to source domains.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#74

Post by iammrpayments »

citrin_ru wrote: post #6
mbb70 wrote: post #2

I'm sure regular airline passengers trip the metal detectors more often than terrorists, doesn't mean we should get rid of the metal detectors.

A better analogy would be a passport. It doesn’t stop all terrorists from boarding a plane at lest it stops already know to authorities ones (unless they have a passport on someone else’s name which is not easy).

I forgot the name of this fallacy, I read about it in Nassim Taleb’s Antifragile a long time ago, but basically being wrong at spam won’t cause a lot of damage while being wrong once about a terrorist may cause thousands of deaths

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#75

Post by ChrisMarshallNY »

dig1 wrote: post #55
upofadown wrote: post #34

SPF/DKIM is really about mail server reputation. So it mostly benefits larger servers like the ones run by Google, Microsoft and Yahoo. Unfortunately, that means that attempts by those larger providers to combat spam using such reputation will naturally hurt smaller providers. So the actual effects of SPF/DKIM are on the whole negative. The root problem is that we don't actually need to keep track of email server rep…

> That implies that we have some work to do on the problem of identity. As it is, there is not even a way for a known email sender to securely introduce an unknown email sender. There is: gpg/pgp signature, but many people find it complicated, primarily because they are reluctant to read the documentation. And it’s popular to criticize it, especially here on HN, in favor of various half-baked alternatives.

> many people find it complicated

That's what kills a lot of these "perfect" implementations.

HN members tend to be nerds, and we don't really have an issue with setting stuff up (many HN IDs, for instance, have Keybase auths).

Most non-HN types have no patience for that stuff. Security needs to be made accessible and easy-to-use, before the vast majority of folks will implement it. That's the single biggest conundrum, IMNSHO.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#76

Post by throw0101c »

globular-toast wrote: post #45
upofadown wrote: post #34

SPF/DKIM is really about mail server reputation. So it mostly benefits larger servers like the ones run by Google, Microsoft and Yahoo. Unfortunately, that means that attempts by those larger providers to combat spam using such reputation will naturally hurt smaller providers. So the actual effects of SPF/DKIM are on the whole negative. The root problem is that we don't actually need to keep track of email server rep…

> As it is, there is not even a way for a known email sender to securely introduce an unknown email sender. You know, the way that regular human people normally are able to transfer identities from one to the other. That's exactly what PGP's web of trust model is for. Someone you know, and trust, can sign and send you a public key of someone that they trust. This new key will be automatically trusted in your trust st…

> SPF/DKIM, as well as TLS etc., is just stupid shit we do because we're too lazy and/or incompetent to make web of trust work for us.

Having key signing parties for the entire world wide web does not seem scalable to me.

* https://en.wikipedia.org/wiki/Key_signing_party

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#77

Post by simiones »

dig1 wrote: post #55
upofadown wrote: post #34

SPF/DKIM is really about mail server reputation. So it mostly benefits larger servers like the ones run by Google, Microsoft and Yahoo. Unfortunately, that means that attempts by those larger providers to combat spam using such reputation will naturally hurt smaller providers. So the actual effects of SPF/DKIM are on the whole negative. The root problem is that we don't actually need to keep track of email server rep…

> That implies that we have some work to do on the problem of identity. As it is, there is not even a way for a known email sender to securely introduce an unknown email sender. There is: gpg/pgp signature, but many people find it complicated, primarily because they are reluctant to read the documentation. And it’s popular to criticize it, especially here on HN, in favor of various half-baked alternatives.

I think everyone can agree that any technology that "isn't complicated if you read the documentation" is by definition complicated. I don't need to read the documentation for Gmail to use Gmail successfully.

Could I, as a trained programmer, use PGP and GPG? I'm sure I could if I spent some time reading about it. Could my 90 year old grandmother, who is otherwise quite comfortable with email and whatsapp? No, not to any meaningful extent.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#78

Post by [deleted] »

ipaddr wrote: post #71
tigeroil wrote: post #32

Earlier quoted context omitted.

You mean like the time I had a salesperson demanding that we turn off Cloudflare across our entire domain because he'd read some random article somewhere saying we should?

The goal of sales isn't to block upto a 1/3 of world wide traffic. Turning off Cloudfare means more traffic and more sales are not blocked. Did you even read the article or did you dismiss it because it came from 'sales'.

[deleted]

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#79

Post by throw0101c »

chillfox wrote: post #22
jeroenhd wrote: post #5

For me, as someone with their own mail server, these technologies mostly serve to inform me that Russian IP addresses are still trying to send email in the name of my domain for some stupid reason. It makes sense that people whose business is sending email know how to set up email correctly. I'm mostly surprised at how many legitimate sysadmins struggle with getting the basics correct. Surely those dozens of DMARC em…

In most organizations there is no point in a sysadmin to spend the effort in understanding how to set it up correctly as Marketing has got more authority on email. Marketing will simply demand changes to the config that they do not understand and there is nothing you can do to stop it as they will have the CEO on their side.

> Marketing will simply demand changes to the config that they do not understand and there is nothing you can do to stop it as they will have the CEO on their side.

Marketing should get their own (sub)domain for sending their missives, that way the primary corporate domain's reputation is not harmed.

Unless you want to run the risk of outgoing e-mails from Finance / Accounts Receivable to be sent to other companies' Junk folder.

Re: Spammers are better at SPF, DKIM, and DMARC than everyone else

#80

Post by FlyingAvatar »

ghusto wrote: post #58
jasode wrote: post #42

Earlier quoted context omitted.

>SPF/DKIM is really about mail server reputation. So it mostly benefits larger servers like the ones run by Google, Microsoft and Yahoo. Unfortunately, that means that attempts by those larger providers to combat span using such reputation will naturally hurt smaller providers. So the actual effects of SPF/DKIM are on the whole negative. That paragraph is incorrect. SPF/DKIM is not about reputation. The main purpose…

And it will mysteriously _stop_ being able to send mail to Google despite you doing everything right, because of whatever nonsense they use to determine reputation.

I am curious as to your experience with this.

Over the years, I have administered a few dozen small to medium domains (depending on the domain 10s to 10,000s emails per month) and the only thing that has ever affected delivery is the reputation of the sending IP address of the mail server (and ensuring DKIM/SPF alignment in more recent years).

Post reply on HN