3 ms·

Don't even get me started on domain spoofing. I get so much junk every day due to bounce backs of people spoofing my domain to send junk. SPF, DKIM and DMARC

Don't even get me started on domain spoofing. I get so much junk every day due to bounce backs of people spoofing my domain to send junk. SPF, DKIM and DMARC have done (and can do) nothing to help. Email is broken, and this, sadly, is the price we pay for the federation it provides for a technology of its age.

simias 8y ago
Are you sure your server is correctly configured? I host my own server on a custom domain and while I do receive a non-negligible amount of spam I don't think I've ever noticed my domain being spoofed. >SPF, DKIM and DMARC have done (and can do) nothing to help. Isn't that precisely what these technologies are supposed to help? Why do you say that they can't do anything?
- kikoreis 8y ago
  You are right that they are designed to prevent spoofing. The problem is that the recipient server needs to be configured to use it and not all servers do, for reasons spanning false positives to ignorance. So if you have a fairly old or known domain you will get non trivial amounts of backscatter from spoofed email being sent to invalid or otherwise rejected addresses.
- alias_neo 8y ago
  Sadly, as the other commenter has pointed out, they rely on the recipient server understanding them. A lot of the fails I get are due to non-existent recipients, full mailboxes and some that detect it as spam end up replying (to me) just to tell me that they've detected it as spam (which I know already, and would prefer they didn't aggravate the issue by replying). Bear in mind, I'm not talking about recieving spam directly (I get almost none) I'm talking about "back scatter" from innocent (but perhaps poorly configured) mail servers telling me they couldn't or wouldn't deliver "my" email. This all goes to randomly generated addresses at my domain (which the spammers using my domain are generating), which I receive at my catch-all and may have to consider disabling, while ensuring my mail server doesn't also notify them that it didn't deliver their bounce back (otherwise I'm perpetuating the issue) all at the risk of losing legitimate emails if they're miss-spelt etc.

simias 8y ago

Are you sure your server is correctly configured? I host my own server on a custom domain and while I do receive a non-negligible amount of spam I don't think I've ever noticed my domain being spoofed. >SPF, DKIM and DMARC have done (and can do) nothing to help. Isn't that precisely what these technologies are supposed to help? Why do you say that they can't do anything?

kikoreis 8y ago
You are right that they are designed to prevent spoofing. The problem is that the recipient server needs to be configured to use it and not all servers do, for reasons spanning false positives to ignorance. So if you have a fairly old or known domain you will get non trivial amounts of backscatter from spoofed email being sent to invalid or otherwise rejected addresses.
alias_neo 8y ago
Sadly, as the other commenter has pointed out, they rely on the recipient server understanding them. A lot of the fails I get are due to non-existent recipients, full mailboxes and some that detect it as spam end up replying (to me) just to tell me that they've detected it as spam (which I know already, and would prefer they didn't aggravate the issue by replying). Bear in mind, I'm not talking about recieving spam directly (I get almost none) I'm talking about "back scatter" from innocent (but perhaps poorly configured) mail servers telling me they couldn't or wouldn't deliver "my" email. This all goes to randomly generated addresses at my domain (which the spammers using my domain are generating), which I receive at my catch-all and may have to consider disabling, while ensuring my mail server doesn't also notify them that it didn't deliver their bounce back (otherwise I'm perpetuating the issue) all at the risk of losing legitimate emails if they're miss-spelt etc.