6 ms·

They both look like spam. B1 is displaying a verified relay that doesnt match the sender domain. The problem seems to be that the author doesnt want to displa

They both look like spam. B1 is displaying a verified relay that doesnt match the sender domain. The problem seems to be that the author doesnt want to display "via way.hanami.com", in which case he should set up DKIM for the domain he actually wants (the redacted domain) instead of "way.hanami.com". Really shouldn't be advertising yourself as a "mail forwarding service" if you dont understand that...

btown 6y ago
Yeah - OP's docs don't even mention adding a DKIM key to your domain: https://hanami.run/docs/cloudflare_email_forwarding https://hanami.run/docs/cloudflare_email_forwarding Compare to Google's instructions for the-artist-formerly-known-as-G-suite: https://support.google.com/a/answer/173535 https://support.google.com/a/answer/173535 Gmail's UI has a lot of quirks (can we talk about how it's a productivity app with a fantastic search, that doesn't let you save searches?) but it's correctly calling out people who don't do DKIM correctly. OP's article doesn't even talk about anything other than DKIM; intended or not, the title is pure clickbait.
- laurent123456 6y ago
  You can actually create filters in Gmail which would be like a saved search. Once you've searched for something, click on the arrow on the right, and then "Create filter".
  - btown 6y ago
    Of course, and you can create labels that track that filter's application in the same way a materialized view would work. But we don't CREATE MATERIALIZED VIEW, or worse yet UPDATE a many-to-many table, every time we want to run an exploratory analysis on our SQL databases and save our ability to rerun that analysis for later, right? Because that would create a ton of bloat, and we might lose track of the labels that we actually want to be permanently meaningful, and if a label is ever added manually, there's no guarantee that the label tracks the initial intent of the search query. And that doesn't even get into the fact that any such labeling is visible as a tag on every matched conversation, leading to a need to have a concise name for your analysis to avoid information overload. Naming things is hard, and when designing interfaces, reducing cognitive load isn't just a nice-to-have.
    - alisonkisk 6y ago
      Gmail used to have saved searches https://irvineco.wixsite.com/goinggoogle/single-post/2014/10/07/this-is-the-title-of-your-first-blog-post https://irvineco.wixsite.com/goinggoogle/single-post/2014/10...
  - agentdrtran 6y ago
    Which you can only re-use by saving the filter as a label, and you can only have about 200 labels before performance starts to torpedo.
  - jfrunyon 6y ago
    Filters are not 'saved searches', they are 'apply this to every incoming message'...
- gpspake 6y ago
  My biggest gripe is that you can't sort by sender. Sure, you can filter but sorting by sender and visually pattern matching is the easiest way to cull and unsub from repetitive promotional emails that might otherwise not stick out in a cluttered inbox. It's absolutely insane to me that in 2021 gmail doesn't have this feature that every other email client has had forever.
upofadown 6y ago
If you add your own DKIM then you have to mangle the from address to make it appear that the email is from your email domain. Which usually means some sort of "via" usage. So that would not fix the problem. This is a generic problem with DKIM, it breaks email forwarding.
- supermatt 6y ago
  DKIM doesnt break anything because it applies to the original message. You simply forward the signature header (well, you forward everything - thats what makes it forwarding!). As I mentioned elsewhere, its not clear what the authors intent is - is it an originating server, or is it a relay. In both cases he shouldnt be signing with the relays key, but should either be signing with the domains key (if available) or forwarding the existing signature. Signing with the relays key is all but useless.
  - upofadown 6y ago
    >DKIM doesnt break anything because it applies to the message body. DKIM applies to what you set it to apply to in the DKIM entry. Here is what Gmail signs from the header (the body is signed by default) for their DKIM (taken from a recent Gmail originated message): h=Content-Type:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:Subject:To:Message-ID:Date:From:MIME-Version:Sender: Reply-To:Cc:Content-Transfer-Encoding:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: In-Reply-To:References:List-Owner; Note the "From" in there along with a whole whack of other fields.
    - megous 6y ago
      That's a From inside the message. MAIL FROM in the SMTP protocol (envelope from, which you change during forwarding) can be anything else, and DKIM will still validate the message.
    - supermatt 6y ago
      Why would you change the from address? The whole point here is to forward, not re-mail. Everything should be forwarded. I kinda agree with what you said, but the point is that you shouldnt be mangling the from address when forwarding. That will definitely break DKIM, as its actually a required header fields in the sig - but theres NO reason to do that. p.s. Ive clarified that i meant "original message" not "message body" in my post. p.p.s Actually, I do think we are in agreement. I mentioned elsewhere that we dont know what the intent was - relay or origin, but in no case should they sign with the relays domain key.
ROARosen 6y ago
> while the message that failed both SPF and DKIM looks correct on their UI. While the behavior can be annoying, the first picture in the article conveniently cuts of the profile image near the sender details. I believe when both fail gmail adds a question mark icon of a red unlock. So no, it doesn't look more correct.
japanuspus 6y ago
For anyone looking for a forwarder that has done their homework, I can recommend forwardememail.net [0]. The developer has commented on the issues here on HN a few times. [0]: https://forwardemail.net/ https://forwardemail.net/
- kureikain 6y ago
  Yes, they are great. But JFI, the email that has invalid SPF and DKIM in the screenshot is the one forwarded by forwardemail.
SavantIdiot 6y ago
> Really shouldn't be advertising yourself as a "mail forwarding service" if you dont understand that... Ouch! But isn't setting up the DKIM the way you suggest the responsibility of the domain owner and not Hanami? EDIT: Nevermind, I just read your replies below. Damn, forwarding is tricky business. OP should hire you. EDIT2: typo
kureikain 6y ago
Hi, I'm the OP. I understand DKIM and i have written this part in the article > Somehow when we signed a message with DKIM, google decided to show the “Via way.hanami.run”, which is technically correct because the message lack of DKIM signature for original email(I made a typo and type gmail in original article) address As in, I agree with gmail decision. My point is that, why when a message has nothing, gmail didn't say "warning: no DKIM signing". I just hope gmail makes that fact clear on their UI when a message has no DKIM signing. And sometime, to reduce minimal work for users, DKIM is optional for them. If they add our public key to `hanami._domain` we will sign it. But it's really tricky to configure DKIM for a normal user. Even gmail makes it optionally. In that case, gmail signed it with gappssmtp.com and yet, they don't say "Via gappssmtp.com"...
- jedberg 6y ago
  > My point is that, why when a message has nothing, gmail didn't say "warning: no DKIM signing". Because 99.9% of users would say "What is a DKIM?" Google has decided that regular uses don't need to know if DKIM and SPF passed or not, because they don't know what that is anyway. They use those things in their spam filtering. If a message got past their filters, regular users assume they are safe, and even if it had DKIM status on it, that wouldn't change. Power users can bring up the second screen you showed if they want to be sure.
  - lstamour 6y ago
    If Chrome operated that way, we would still have broken locks on mixed-content SSL pages and no warning at all on non-SSL pages. The fact is, an attempt at security is better than no attempt at all, and visibly marking the insecure option as less secure is better than pretending security doesn’t exist unless it’s implemented 100% as expected (lock icon appears, etc.)
    - jedberg 6y ago
      I agree with you in theory, but in practice they are very different situations. For websites, the website owner loses traffic if they don't offer a secure experience -- they are in complete control of their destiny. For email, the user loses deliverability and may not even be aware of it. Also it's often not within their control to fix. Marking non-signed emails as such would put a huge burden on email users and they might not even be aware of it.

btown 6y ago

Yeah - OP's docs don't even mention adding a DKIM key to your domain: https://hanami.run/docs/cloudflare_email_forwarding https://hanami.run/docs/cloudflare_email_forwarding Compare to Google's instructions for the-artist-formerly-known-as-G-suite: https://support.google.com/a/answer/173535 https://support.google.com/a/answer/173535 Gmail's UI has a lot of quirks (can we talk about how it's a productivity app with a fantastic search, that doesn't let you save searches?) but it's correctly calling out people who don't do DKIM correctly. OP's article doesn't even talk about anything other than DKIM; intended or not, the title is pure clickbait.

laurent123456 6y ago
You can actually create filters in Gmail which would be like a saved search. Once you've searched for something, click on the arrow on the right, and then "Create filter".
- btown 6y ago
  Of course, and you can create labels that track that filter's application in the same way a materialized view would work. But we don't CREATE MATERIALIZED VIEW, or worse yet UPDATE a many-to-many table, every time we want to run an exploratory analysis on our SQL databases and save our ability to rerun that analysis for later, right? Because that would create a ton of bloat, and we might lose track of the labels that we actually want to be permanently meaningful, and if a label is ever added manually, there's no guarantee that the label tracks the initial intent of the search query. And that doesn't even get into the fact that any such labeling is visible as a tag on every matched conversation, leading to a need to have a concise name for your analysis to avoid information overload. Naming things is hard, and when designing interfaces, reducing cognitive load isn't just a nice-to-have.
  - alisonkisk 6y ago
    Gmail used to have saved searches https://irvineco.wixsite.com/goinggoogle/single-post/2014/10/07/this-is-the-title-of-your-first-blog-post https://irvineco.wixsite.com/goinggoogle/single-post/2014/10...
- agentdrtran 6y ago
  Which you can only re-use by saving the filter as a label, and you can only have about 200 labels before performance starts to torpedo.
- jfrunyon 6y ago
  Filters are not 'saved searches', they are 'apply this to every incoming message'...
gpspake 6y ago
My biggest gripe is that you can't sort by sender. Sure, you can filter but sorting by sender and visually pattern matching is the easiest way to cull and unsub from repetitive promotional emails that might otherwise not stick out in a cluttered inbox. It's absolutely insane to me that in 2021 gmail doesn't have this feature that every other email client has had forever.

upofadown 6y ago

If you add your own DKIM then you have to mangle the from address to make it appear that the email is from your email domain. Which usually means some sort of "via" usage. So that would not fix the problem. This is a generic problem with DKIM, it breaks email forwarding.

supermatt 6y ago
DKIM doesnt break anything because it applies to the original message. You simply forward the signature header (well, you forward everything - thats what makes it forwarding!). As I mentioned elsewhere, its not clear what the authors intent is - is it an originating server, or is it a relay. In both cases he shouldnt be signing with the relays key, but should either be signing with the domains key (if available) or forwarding the existing signature. Signing with the relays key is all but useless.
- upofadown 6y ago
  >DKIM doesnt break anything because it applies to the message body. DKIM applies to what you set it to apply to in the DKIM entry. Here is what Gmail signs from the header (the body is signed by default) for their DKIM (taken from a recent Gmail originated message): h=Content-Type:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:Subject:To:Message-ID:Date:From:MIME-Version:Sender: Reply-To:Cc:Content-Transfer-Encoding:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: In-Reply-To:References:List-Owner; Note the "From" in there along with a whole whack of other fields.
  - megous 6y ago
    That's a From inside the message. MAIL FROM in the SMTP protocol (envelope from, which you change during forwarding) can be anything else, and DKIM will still validate the message.
  - supermatt 6y ago
    Why would you change the from address? The whole point here is to forward, not re-mail. Everything should be forwarded. I kinda agree with what you said, but the point is that you shouldnt be mangling the from address when forwarding. That will definitely break DKIM, as its actually a required header fields in the sig - but theres NO reason to do that. p.s. Ive clarified that i meant "original message" not "message body" in my post. p.p.s Actually, I do think we are in agreement. I mentioned elsewhere that we dont know what the intent was - relay or origin, but in no case should they sign with the relays domain key.

ROARosen 6y ago

> while the message that failed both SPF and DKIM looks correct on their UI. While the behavior can be annoying, the first picture in the article conveniently cuts of the profile image near the sender details. I believe when both fail gmail adds a question mark icon of a red unlock. So no, it doesn't look more correct.

japanuspus 6y ago

For anyone looking for a forwarder that has done their homework, I can recommend forwardememail.net [0]. The developer has commented on the issues here on HN a few times. [0]: https://forwardemail.net/ https://forwardemail.net/

kureikain 6y ago
Yes, they are great. But JFI, the email that has invalid SPF and DKIM in the screenshot is the one forwarded by forwardemail.

SavantIdiot 6y ago

> Really shouldn't be advertising yourself as a "mail forwarding service" if you dont understand that... Ouch! But isn't setting up the DKIM the way you suggest the responsibility of the domain owner and not Hanami? EDIT: Nevermind, I just read your replies below. Damn, forwarding is tricky business. OP should hire you. EDIT2: typo

kureikain 6y ago

Hi, I'm the OP. I understand DKIM and i have written this part in the article > Somehow when we signed a message with DKIM, google decided to show the “Via way.hanami.run”, which is technically correct because the message lack of DKIM signature for original email(I made a typo and type gmail in original article) address As in, I agree with gmail decision. My point is that, why when a message has nothing, gmail didn't say "warning: no DKIM signing". I just hope gmail makes that fact clear on their UI when a message has no DKIM signing. And sometime, to reduce minimal work for users, DKIM is optional for them. If they add our public key to `hanami._domain` we will sign it. But it's really tricky to configure DKIM for a normal user. Even gmail makes it optionally. In that case, gmail signed it with gappssmtp.com and yet, they don't say "Via gappssmtp.com"...

jedberg 6y ago
> My point is that, why when a message has nothing, gmail didn't say "warning: no DKIM signing". Because 99.9% of users would say "What is a DKIM?" Google has decided that regular uses don't need to know if DKIM and SPF passed or not, because they don't know what that is anyway. They use those things in their spam filtering. If a message got past their filters, regular users assume they are safe, and even if it had DKIM status on it, that wouldn't change. Power users can bring up the second screen you showed if they want to be sure.
- lstamour 6y ago
  If Chrome operated that way, we would still have broken locks on mixed-content SSL pages and no warning at all on non-SSL pages. The fact is, an attempt at security is better than no attempt at all, and visibly marking the insecure option as less secure is better than pretending security doesn’t exist unless it’s implemented 100% as expected (lock icon appears, etc.)
  - jedberg 6y ago
    I agree with you in theory, but in practice they are very different situations. For websites, the website owner loses traffic if they don't offer a secure experience -- they are in complete control of their destiny. For email, the user loses deliverability and may not even be aware of it. Also it's often not within their control to fix. Marking non-signed emails as such would put a huge burden on email users and they might not even be aware of it.