8 ms·

As someone who runs their own personal mail server, this annoys me to no end. I set up DKIM, SPF, and reverse-DNS records and resented every moment of it. Even

As someone who runs their own personal mail server, this annoys me to no end. I set up DKIM, SPF, and reverse-DNS records and resented every moment of it. Even after all that, there's some chance that an email from my server will be marked as insecure/spam or otherwise just not be delivered because Google has come up with some new brilliant mail security/auth/permission scheme that the world has to adopt tomorrow or be cut off from all Gmail users.

macspoofing 7y ago
>Even after all that, there's some chance that an email from my server will be marked as insecure/spam Don't I know it. This happened to us but not with Google. We use Exchange Online (Office365) and have DKIM, SPF headers configured. At some point our emails stopped being received by bell and cox emails addresses ... sporadically but sometimes for days at a time. It turned out that the spam filter provider (used by bell and maybe cox) correlated one innocuous phrase in our confidentiality notice (which is appended to all outgoing email signatures) with spam and therefore marked the entire email as spam as well.
- Leace 7y ago
  To be honest I don't like this confidentiality notes and from what I've read (not a lawyer) they don't have any practical effect either.
  - macspoofing 7y ago
    It's there, it wasn't my call to put it in.
  - reaperducer 7y ago
    I always giggle when I see those. Especially the part about how "if you are not the intended recipient, you are ordered to destroy all copies of this message." It's my computer. You sent the bad message. You're in no position to "order" me to do anything. I suspect they're mandated by self-important Lower Middle Manager of the Year Award nominees, not actual legal departments. The sort of people who never do anything but push papers around, yet put a bunch of meaningless initials after their name in e-mail signatures because they went to a conference.
    - crankylinuxuser 7y ago
      And cargo-culting. Most email templates are set up from old instructions hanging around confluence or a wiki. And they are rarely, if ever, actually vetted by legal. It 'feels' good, so it stays.
    - Wowfunhappy 7y ago
      > Especially the part about how "if you are not the intended recipient, you are ordered to destroy all copies of this message." It's my computer. You sent the bad message. You're in no position to "order" me to do anything. Best case scenario, someone listens and destroys the message. Worst case scenario, the company is no worse off than if they hadn't included the disclaimer. Makes sense from my perspective.
  - rhizome 7y ago
    Forget it, Jake. I have a doctor who has a big old footer, "If you have any questions, reply to this HIPAA-compliant email." I explained the problem with this in detail, but it's still there.
- lucb1e 7y ago
  > we use Office365 and don't have this issue I'm not surprised Microsoft's IP range is known by google. Sending from sendgrid, mailchimp, and a few others that send a lot of mail also works. It's when a new player wants to get in the market (or god forbid, an individual with their own nerdy server) where the trouble arises.
  - macspoofing 7y ago
    To clarify, I wasn't arguing that sending email to Gmail is easy especially if you're using an independent provider that is unknown to Google - which is how you're framing my response as (why?). I was acknowledging the general issue of dealing with modern email problems and how opaque the underlying systems are.
  - fgonzag 7y ago
    Postmark requires a minimum of 50K emails a month for a dedicated IP address, and they state that minimum is for quality reasons. You won't get a good enough reputation on your IP without it. That should give people an estimate of the required volume to get decent delivirability rates to big providers.
lupire 7y ago
Do you resent HTTPS too? I'd rather turn on encryption/signing/security for my mail than contribute to a system like the telephone network where bank accounts get emptied by transoceanic criminal networks on the regular.
- lucb1e 7y ago
  Asking whether anyone resents using https is just being snarky. You know the answer and the obviousness of it makes it condescending. We all agree that https is good, so comparing that to spf and dkim is like saying GP is stupid for not having enjoyed it. Even ignoring spf and the other anti-spam tech that doesn't do anything remotely like https, dkim only signs messages. Https is more like pgp or s/mime, not dkim. It's like posting the hash when you share a binary online: the recipient can verify the integrity and sender (namely, whoever put up the hash), but I don't think anyone considers a signed binary to be private like bank transactions done with https.
- i_dont_know_ 7y ago
  I do actually resent the way google imposed HTTPS everywhere, but my issues were with the rollout as opposed to the tech. Rant for another day :) But with the security/encryption/signing for email... yeah, if it was just an "on" switch somewhere, I'd be all for it. Unfortunately, setting up SPF for something like exim isn't very straightforward at all. It's flipping LOTS of "on" switches in lots of different places, generating and copying keys around, setting permissions on all the files properly, testing etc. It turns into a legitimate project fairly quickly, and it's hard to prove that this is a better method than just really well-trained spam filters. So, basically, it ends up being by Google fiat that I had to do that project.
  - yjftsjthsd-h 7y ago
    Nitpick: you appear to be describing dkim; SPF is a single setting in a single DNS record (per sending domain) and requires no modifications on the sending server
  - tssva 7y ago
    Are you thinking of DKIM? SPF only requires configuring a DNS entry. Also DKIM did not start with Google. DKIM was originally the work of Yahoo and Cisco. Yahoo, now OATH, has a patent covering it.
oldjokes 7y ago
It's not just email, it seems like any service is at risk of being ignored through malice or just being too tiny it gets neglected if it doesn't help the walled garden somehow. At one point I heard a rumor that no human had worked on Google Finance in over a year, simply because nobody was interested. Not their biggest service of course, but still a major site that presumably generates a lot of revenue. If they think that global finance is "too boring" for their amazing engineers then support for everything is liable to be canceled at any moment.
- Kalium 7y ago
  > but still a major site that presumably generates a lot of revenue That's very possible! It's definitely an amazing site and it's absolutely clear that it could drive revenue. With that said, perhaps it might be like Google News, where it not only doesn't generate profits, but doesn't generate any revenue at all? Is it possible that being a major site and generating revenue might be entirely distinct?
  - oldjokes 7y ago
    There's no need to be nasty and sarcastic.
    - Kalium 7y ago
      Please accept my heartfelt apologies! I can see I was unclear in my genuineness. Let me restate. It is, in my opinion, possible that Google Finance is in a position like that of Google News and thus generates no revenue. Have you considered this possibility? Do you think it might affect the willingness of people to work on a product? If I'm utterly wrong, I would love to know so that I can avoid being wrong this way in the future.
      - Balgair 7y ago
        Kalium, I'm going against my better judgement here, but I'm hoping that you are trying to apologize for real. As such, more feedback may be useful to you. You tend to do this a lot and it does come off as very sarcastic, mocking, and/or un-genuine. As in, like, every sixth comment you leave. Usually, you say something like : "You're right!" or "You're totally correct!" and then you exaggerate the point the person was trying to make, so much so that it comes off as mocking the comment and the person. If you are mocking them, stop. It doesn't add anything to the conversation. You are a pretty quick and sharp person, and you make a lot of very good points. So that's why I'm leaving this comment at all. You may just not realize that this is what you are doing. I'm hoping that you just haven't seen that your style of commenting is coming across very badly. But if you are trying to do this on purpose, stop it.
Chlorus 7y ago
Uh, SPF was being developed long before Gmail was a thing and was pushed for by at least 1 other (Yahoo) mass mail provider, as was reverse DNS verification. If you're going to be salty at someone, it should be the spammers.
- the_jeremy 7y ago
  Perhaps he was indirectly referring to MTA-STS[1] that Google sponsored, co-authored, and recently released in beta? [1]: https://gsuiteupdates.googleblog.com/2019/04/gmail-making-email-more-secure-with-mta-sts.html https://gsuiteupdates.googleblog.com/2019/04/gmail-making-em...
  - ehsankia 7y ago
    I think the point still stands. As annoying as any of these technologies can be for someone maintaining a mail server, the unfortunate reality is that we don't live in the early web utopia anymore. There are people seriously trying to bypass and break these systems, which is why these protocols are needed. Being angry at them doesn't solve the underlying issue.

macspoofing 7y ago

>Even after all that, there's some chance that an email from my server will be marked as insecure/spam Don't I know it. This happened to us but not with Google. We use Exchange Online (Office365) and have DKIM, SPF headers configured. At some point our emails stopped being received by bell and cox emails addresses ... sporadically but sometimes for days at a time. It turned out that the spam filter provider (used by bell and maybe cox) correlated one innocuous phrase in our confidentiality notice (which is appended to all outgoing email signatures) with spam and therefore marked the entire email as spam as well.

Leace 7y ago
To be honest I don't like this confidentiality notes and from what I've read (not a lawyer) they don't have any practical effect either.
- macspoofing 7y ago
  It's there, it wasn't my call to put it in.
- reaperducer 7y ago
  I always giggle when I see those. Especially the part about how "if you are not the intended recipient, you are ordered to destroy all copies of this message." It's my computer. You sent the bad message. You're in no position to "order" me to do anything. I suspect they're mandated by self-important Lower Middle Manager of the Year Award nominees, not actual legal departments. The sort of people who never do anything but push papers around, yet put a bunch of meaningless initials after their name in e-mail signatures because they went to a conference.
  - crankylinuxuser 7y ago
    And cargo-culting. Most email templates are set up from old instructions hanging around confluence or a wiki. And they are rarely, if ever, actually vetted by legal. It 'feels' good, so it stays.
  - Wowfunhappy 7y ago
    > Especially the part about how "if you are not the intended recipient, you are ordered to destroy all copies of this message." It's my computer. You sent the bad message. You're in no position to "order" me to do anything. Best case scenario, someone listens and destroys the message. Worst case scenario, the company is no worse off than if they hadn't included the disclaimer. Makes sense from my perspective.
- rhizome 7y ago
  Forget it, Jake. I have a doctor who has a big old footer, "If you have any questions, reply to this HIPAA-compliant email." I explained the problem with this in detail, but it's still there.
lucb1e 7y ago
> we use Office365 and don't have this issue I'm not surprised Microsoft's IP range is known by google. Sending from sendgrid, mailchimp, and a few others that send a lot of mail also works. It's when a new player wants to get in the market (or god forbid, an individual with their own nerdy server) where the trouble arises.
- macspoofing 7y ago
  To clarify, I wasn't arguing that sending email to Gmail is easy especially if you're using an independent provider that is unknown to Google - which is how you're framing my response as (why?). I was acknowledging the general issue of dealing with modern email problems and how opaque the underlying systems are.
- fgonzag 7y ago
  Postmark requires a minimum of 50K emails a month for a dedicated IP address, and they state that minimum is for quality reasons. You won't get a good enough reputation on your IP without it. That should give people an estimate of the required volume to get decent delivirability rates to big providers.

lupire 7y ago

Do you resent HTTPS too? I'd rather turn on encryption/signing/security for my mail than contribute to a system like the telephone network where bank accounts get emptied by transoceanic criminal networks on the regular.

lucb1e 7y ago
Asking whether anyone resents using https is just being snarky. You know the answer and the obviousness of it makes it condescending. We all agree that https is good, so comparing that to spf and dkim is like saying GP is stupid for not having enjoyed it. Even ignoring spf and the other anti-spam tech that doesn't do anything remotely like https, dkim only signs messages. Https is more like pgp or s/mime, not dkim. It's like posting the hash when you share a binary online: the recipient can verify the integrity and sender (namely, whoever put up the hash), but I don't think anyone considers a signed binary to be private like bank transactions done with https.
i_dont_know_ 7y ago
I do actually resent the way google imposed HTTPS everywhere, but my issues were with the rollout as opposed to the tech. Rant for another day :) But with the security/encryption/signing for email... yeah, if it was just an "on" switch somewhere, I'd be all for it. Unfortunately, setting up SPF for something like exim isn't very straightforward at all. It's flipping LOTS of "on" switches in lots of different places, generating and copying keys around, setting permissions on all the files properly, testing etc. It turns into a legitimate project fairly quickly, and it's hard to prove that this is a better method than just really well-trained spam filters. So, basically, it ends up being by Google fiat that I had to do that project.
- yjftsjthsd-h 7y ago
  Nitpick: you appear to be describing dkim; SPF is a single setting in a single DNS record (per sending domain) and requires no modifications on the sending server
- tssva 7y ago
  Are you thinking of DKIM? SPF only requires configuring a DNS entry. Also DKIM did not start with Google. DKIM was originally the work of Yahoo and Cisco. Yahoo, now OATH, has a patent covering it.

oldjokes 7y ago

It's not just email, it seems like any service is at risk of being ignored through malice or just being too tiny it gets neglected if it doesn't help the walled garden somehow. At one point I heard a rumor that no human had worked on Google Finance in over a year, simply because nobody was interested. Not their biggest service of course, but still a major site that presumably generates a lot of revenue. If they think that global finance is "too boring" for their amazing engineers then support for everything is liable to be canceled at any moment.

Kalium 7y ago
> but still a major site that presumably generates a lot of revenue That's very possible! It's definitely an amazing site and it's absolutely clear that it could drive revenue. With that said, perhaps it might be like Google News, where it not only doesn't generate profits, but doesn't generate any revenue at all? Is it possible that being a major site and generating revenue might be entirely distinct?
- oldjokes 7y ago
  There's no need to be nasty and sarcastic.
  - Kalium 7y ago
    Please accept my heartfelt apologies! I can see I was unclear in my genuineness. Let me restate. It is, in my opinion, possible that Google Finance is in a position like that of Google News and thus generates no revenue. Have you considered this possibility? Do you think it might affect the willingness of people to work on a product? If I'm utterly wrong, I would love to know so that I can avoid being wrong this way in the future.
    - Balgair 7y ago
      Kalium, I'm going against my better judgement here, but I'm hoping that you are trying to apologize for real. As such, more feedback may be useful to you. You tend to do this a lot and it does come off as very sarcastic, mocking, and/or un-genuine. As in, like, every sixth comment you leave. Usually, you say something like : "You're right!" or "You're totally correct!" and then you exaggerate the point the person was trying to make, so much so that it comes off as mocking the comment and the person. If you are mocking them, stop. It doesn't add anything to the conversation. You are a pretty quick and sharp person, and you make a lot of very good points. So that's why I'm leaving this comment at all. You may just not realize that this is what you are doing. I'm hoping that you just haven't seen that your style of commenting is coming across very badly. But if you are trying to do this on purpose, stop it.

Chlorus 7y ago

Uh, SPF was being developed long before Gmail was a thing and was pushed for by at least 1 other (Yahoo) mass mail provider, as was reverse DNS verification. If you're going to be salty at someone, it should be the spammers.

the_jeremy 7y ago
Perhaps he was indirectly referring to MTA-STS[1] that Google sponsored, co-authored, and recently released in beta? [1]: https://gsuiteupdates.googleblog.com/2019/04/gmail-making-email-more-secure-with-mta-sts.html https://gsuiteupdates.googleblog.com/2019/04/gmail-making-em...
- ehsankia 7y ago
  I think the point still stands. As annoying as any of these technologies can be for someone maintaining a mail server, the unfortunate reality is that we don't live in the early web utopia anymore. There are people seriously trying to bypass and break these systems, which is why these protocols are needed. Being angry at them doesn't solve the underlying issue.