4 ms·

I'm confused. How is it in 2019 that financial services companies, in particular ostensibly internet savvy companies, aren't using DMARC? How in the world can a

by cmurf 8y ago

I'm confused. How is it in 2019 that financial services companies, in particular ostensibly internet savvy companies, aren't using DMARC? How in the world can authenticated legitimate emails ever end up in spam? And surely by now Google spam filtering has a pretty good idea what emails can be categorized as "financial institution" likely, and if they aren't conforming to an agreed upon DMARC policy to put those in spam? Or even better, a mandatory agreed upon tag that indicates the content is 'financial institution account security notification' related (i.e. not marketing spam from that institution), but any emails that use that tag but don't also use the agreed upon DMARC policy always go to spam.

massaman_yams 8y ago
DMARC already allows a domain owner to specify a recommended action (no action, quarantine, or reject) to take in the event an ISP receives a message that fails DMARC. This DMARC policy can be published at the subdomain level, and best practice is for organizations to use separate IPs/subdomains for sending different types of mail traffic (security notifications vs. marketing, for example), so security notifications can have a significantly stricter policy than marketing mail. In the paypal example, the 'via' in the from address line is an indicator the message is not DMARC aligned (but doesn't tell us whether or not the actual originating domain publishes a formal DMARC record - I can't tell that since it's blacked out in the GH post). So for the paypal example, you're right, it looks like they're most likely not following best practices. It may be possible that the 'via' domain is simply a different legitimate paypal domain, which is an edge case that DMARC isn't designed to cover - I think we'll see a technical standard emerge in the next 5 years to handle that kind of thing; maybe built on some of what BIMI is doing - https://www.ietf.org/id/draft-bkl-bimi-overview-00.txt https://www.ietf.org/id/draft-bkl-bimi-overview-00.txt
unilynx 8y ago
Why should DMARC (unless combined with a whitelist) be a non-spam signal ? Spammers would quickly learn to set up the proper DNS records.
- massaman_yams 8y ago
  It's less about the presence of DMARC in general, so much as the fact that the presence of full DMARC alignment (even in the absence of a formal DMARC record) allows ISPs to make more confident assessments of that sender's reputation.
- progval 8y ago
  And they do. For a time I got a large amount of spam from dozens of cheap domains registered at Namecheap (which sold .bid domains for 0.99€). Additionally, each had a valid DKIM signature. I notified Namecheap, including the DKIM signatures, but they told me they couldn't do anything about most of them because "they are hosted with another company". ¯\_(ツ)_/¯ Though if the registrar deleted quickly these domains AND didn't make them so ridiculously cheap, maybe it would become too expansive for spammers.
  - lucb1e 8y ago
    I also don't really get why we don't apply spam filtering retroactively a few seconds/minutes after it arrived. At first you don't know the domain yet, but at some point you can go "oh, this domain now reached more than 1000 different inboxes for the first time, and of the 50 users who saw the message, 45%* marked it as spam. Must be spam, let's move these and future messages to spam folders for all who haven't downloaded/opened the message yet." There is so much spam that is (nearly) identical and reaches a large percentage of people, but it's just left in the inbox for years by outlook/gmail/etc., even if I don't log into the account for months at a time. If the spammers can only reach an initial small sample and the domain is next to useless after that, even 99ct domains should not be worth it. * Or whatever is a normal number. I know lots of people just leave the message as 'read' and don't bother marking it. I don't know how many users do this. Maybe one could also keep track of users who regularly mark something as spam and only count the percentage among those.
    - jcranmer 8y ago
      Spam filtering already relies on throttling. If you're a domain with unknown reputation, you're generally forbidden [by the recipient] from sending a lot of email until a reputation is established.

by cmurf 8y ago

massaman_yams 8y ago

DMARC already allows a domain owner to specify a recommended action (no action, quarantine, or reject) to take in the event an ISP receives a message that fails DMARC. This DMARC policy can be published at the subdomain level, and best practice is for organizations to use separate IPs/subdomains for sending different types of mail traffic (security notifications vs. marketing, for example), so security notifications can have a significantly stricter policy than marketing mail. In the paypal example, the 'via' in the from address line is an indicator the message is not DMARC aligned (but doesn't tell us whether or not the actual originating domain publishes a formal DMARC record - I can't tell that since it's blacked out in the GH post). So for the paypal example, you're right, it looks like they're most likely not following best practices. It may be possible that the 'via' domain is simply a different legitimate paypal domain, which is an edge case that DMARC isn't designed to cover - I think we'll see a technical standard emerge in the next 5 years to handle that kind of thing; maybe built on some of what BIMI is doing - https://www.ietf.org/id/draft-bkl-bimi-overview-00.txt https://www.ietf.org/id/draft-bkl-bimi-overview-00.txt

unilynx 8y ago

Why should DMARC (unless combined with a whitelist) be a non-spam signal ? Spammers would quickly learn to set up the proper DNS records.

massaman_yams 8y ago
It's less about the presence of DMARC in general, so much as the fact that the presence of full DMARC alignment (even in the absence of a formal DMARC record) allows ISPs to make more confident assessments of that sender's reputation.
progval 8y ago
And they do. For a time I got a large amount of spam from dozens of cheap domains registered at Namecheap (which sold .bid domains for 0.99€). Additionally, each had a valid DKIM signature. I notified Namecheap, including the DKIM signatures, but they told me they couldn't do anything about most of them because "they are hosted with another company". ¯\_(ツ)_/¯ Though if the registrar deleted quickly these domains AND didn't make them so ridiculously cheap, maybe it would become too expansive for spammers.
- lucb1e 8y ago
  I also don't really get why we don't apply spam filtering retroactively a few seconds/minutes after it arrived. At first you don't know the domain yet, but at some point you can go "oh, this domain now reached more than 1000 different inboxes for the first time, and of the 50 users who saw the message, 45%* marked it as spam. Must be spam, let's move these and future messages to spam folders for all who haven't downloaded/opened the message yet." There is so much spam that is (nearly) identical and reaches a large percentage of people, but it's just left in the inbox for years by outlook/gmail/etc., even if I don't log into the account for months at a time. If the spammers can only reach an initial small sample and the domain is next to useless after that, even 99ct domains should not be worth it. * Or whatever is a normal number. I know lots of people just leave the message as 'read' and don't bother marking it. I don't know how many users do this. Maybe one could also keep track of users who regularly mark something as spam and only count the percentage among those.
  - jcranmer 8y ago
    Spam filtering already relies on throttling. If you're a domain with unknown reputation, you're generally forbidden [by the recipient] from sending a lot of email until a reputation is established.