3 ms·
The author is still pretty far behind the curve with this info. Unfortunately while these policies are great to have (well these days they are more or less nece
by gorkish 8y ago
The author is still pretty far behind the curve with this info. Unfortunately while these policies are great to have (well these days they are more or less necessary), the simple fact is that they are so often misused or improperly maintained they don't really stop that much; a SPF mismatch is simply treated as another item to score the likeliness that a message should or should not be blocked. A DKIM signature is almost completely useless in this system since all it can do is prove a message was handled by a specific domain holder and not modified. So if you want to modify it, just remove the signature. If you want to send a forged message, don't sign it. There's nothing in DKIM itself to tell a recipient "my messages must be signed."
The new hotness is a DMARC record, and it finally allows mail senders to basically say "Here are my suggested handling policies for DKIM and SPF, and please actually enforce them because they are properly maintained and tested." Best of all it has a feedback loop, so you are able get reports of how receiving hosts are treating your messages and forensic reports of forgeries which can help with detection of several types of phishing threats.
It's still a long way from perfect, but it's better. It doesn't help deliverability though. For that you will want to stop emailing shit that people don't want.
- mehrdadn 8y agoThe new hotness is ARC (arc-spec.org), which I understand came out of DMARC? Not sure though, don't know too much about it. For DMARC, it's not so awesome :\ https://news.ycombinator.com/item?id=17900765 https://news.ycombinator.com/item?id=17900765
- Alex3917 8y agoBasically mailing lists break DKIM signatures, and ARC fixes that. It also fixes certain types of automatic message forwarding, e.g. when you have account forwarding turned on, not when you hit the forward button.
- massaman_yams 8y agoIn short: ARC builds on top of DMARC to fix some cases that DMARC didn't handle well. (And DMARC, in turn, builds on top of DKIM and SPF.) DMARC is overall a very good thing, and has significantly cut back on the effectiveness of forged email for spam/phishing, at the expense of mailing list/forwarding headaches.
- mehrdadn 8y agoHopefully it's been good for other people... I haven't seen any benefit personally. :\ On a related note: do you know if DMARC feedback leaks information to the sender on whether or not you opened an email, or reported it as spam, or similar? If so, do you know why this isn't considered a privacy or security issue?
- Ionlyprograminc 8y agoDMARC feedback is only based on the MTA (Message Transport Agent) handling the mail. I don't have much experience with DMARC reports but Senders typically use it when they are first Setting up DMARC. It is up to the receiving MTA to send the inbox/spam result according to the RFC. I think that the reports are aggregated so single inboxes are not able to be detected. I don't think many people actually send / follow up on DMARC reports imo. Source: https://tools.ietf.org/html/rfc7489#section-7.3 https://tools.ietf.org/html/rfc7489#section-7.3
- massaman_yams 8y agoRecipient activity is not part of DMARC, so there are no concerns there.
- gorkish 8y agoDMARC is for the sender ARC is for the receiver/intermediary. The problem with DMARC (really it's not a problem with DMARC but we'll play like it is) is that if you do something like set up a Gmail account to forward mail to your "real" yahoo account then yahoo might not accept the message from Gmail since from yahoo's perspective Gmail is trying to dump a forged message into your box that they didn't originate. As a sender I don't really give a shit that the other end is broken by some lazy person.
- mehrdadn 8y agoHow is the message considered forged when it passes DKIM though?
- Ionlyprograminc 8y agoA message can still be considered a DMARC failure since the check depends on both SPF and DKIM. You can have various failures like recipient rewrites and general SPF/DKIM failures which will fail DMARC a significant amount of the time.