10 ms·

Gmail accepts forged YouTube emails

296 points by jmillikin 4y ago

jesprenj 4y ago
Could there be a Sender header that was being verified instead of the From? Is that how it works? What about envelope From? Which of those are even protected by DKIM/SPF?
actionablefiber 4y ago
Any ideas for why that email appeared in your inbox? It doesn't look like it's a phishing attack - "Updates to YouTube's Terms of Service" is a subject line that guarantees that precisely zero people will even bother opening it.
- jessetemp 4y ago
  Phishing bored lawyers?
- RL_Quine 4y ago
  An attempt at increasing reputation? Nobody is going to mark that as a spam.
  - yreg 4y ago
    I'm sure many people will mark anything they are not interested in as spam.
    - hn_throwaway_69 4y ago
      My rule: If there isn't a prominent, 1-click unsubscribe link in an email, it gets marked as spam. If I click unsubscribe, and the form asks me to fill in information, it gets marked as spam. No, I'm not filling in my email, let alone completing a CAPTCHA, to ask you to stop sending me emails. However, I don't click an unsubscribe link in an email where I suspect the unsubscribe link is itself a scam to collect information.
      - RL_Quine 4y ago
        I've been toying with just automatically trashing any email that contains the string "unsubscribe", in any context.
  - haruka_ff 4y ago
    This actually sounds like the most plausible reason considering there is really no other incentive to do this.
- tiagod 4y ago
  Perhaps to check if the inbox is valid? Sending from some random domain you risk having your mail silently dropped. If the server thinks you're youtube, then you're going to get through.
- quickthrower2 4y ago
  Close to zero, which is lots for a spammer.
  - sodality2 4y ago
    Yes, but those likely to read ToS updates are not going to be the demographic that likely falls for scams; proper scammers target the population that is less adept at technology so they don't notice they're being duped.
tiagod 4y ago
This looks like a hint to why this message was accepted with failed dmarc: http://lists.dmarc.org/pipermail/dmarc-discuss/2013-April/001848.html http://lists.dmarc.org/pipermail/dmarc-discuss/2013-April/00...
RKearney 4y ago
The reason for this is right in the headers. The message had a valid ARC headers used to preserve DKIM/SPF/DMARC checks when forwarding email. https://en.wikipedia.org/wiki/Authenticated_Received_Chain https://en.wikipedia.org/wiki/Authenticated_Received_Chain
- jeffbee 4y ago
  Correct, this message isn't forged, it's authentic. You can check the signature yourself.
  - gouggoug 4y ago
    > Correct, this message isn't forged, it's authentic I personally receive a lot of emails that aren't addressed to me and aren't marked as spam and have always wondered how this works. Can someone go into a bit more details about why this works? In what way is this message authentic? The ARC wiki page says "Validating an ARC chain only makes sense if the receiver trusts the ARC signers."; in this case the receiver is Gmail. Why does gmail trust a random domain (robtoledoyour.com)?
    - colbertw08 4y ago
      Yes I would love to know why this works as well. I've noticed over the past few months, I get emails that land in my gmail inbox that are obviously spam (various bs offers), and I've always wondered how they are able to bypass the spam filter with ease it seems. Also the To email line is to an email address that is a variation of my email address @aol.com that doesn't actually exist
      - XorNot 4y ago
        The latest thing that started happening a week or two ago was an endless stream of unsolicited mailing list messages addressed to "Prunella" trying to get me to click on links. Ended up just setting up an autodelete when that name is in the Send field (because I discovered Gmail doesn't let you auto-spam folder things).
ocdtrekkie 4y ago
On one hand, they aren't special casing their own products, so good on them I guess? On the other hand, if they can't detect this, what point is their spam filtering even? Public mail services can be surprisingly bad at what they decide not to catch. I love Fastmail but because some existing customers rely on it, the default behavior is not to block inbound emails with the same domain as you've delegated entirely to Fastmail. One would expect a given provider should, unless instructed explicitly otherwise, block outside emails from domains it controls mail for.
- KennyBlanken 4y ago
  > One would expect a given provider should, unless instructed explicitly otherwise, block outside emails from domains it controls mail for. It's not even something you need to specifically craft much infrastructure for. There are public standards for "don't accept email from this domain unless the sender has a cert encrypted by one of these CAs" (Google runs their own CA, yes?) and "don't accept email from this domain except from these servers" and so on.
Eridrus 4y ago
I'm not really an expert on this, so I don't know why someone is doing this here, but it sounds like a DKIM replay attack: https://proton.me/news/dkim-replay-attack-breakdown https://proton.me/news/dkim-replay-attack-breakdown
KennyBlanken 4y ago
Meanwhile, Gmail is obsessed with tagging messages I get from nearly every mailing list I'm on, including ones hosted by google groups, as spam. Even messages sent by a gmail user, to a google group. Outdoor groups? Spam. Technical mailing lists? Spam. Social group mailing lists? Spam. I have filters assigning these messages to labels. I have been on some of these lists for ten fucking years. I routinely go into my spam folder and find a dozen messages from these lists tagged as spam, dutifully click "not spam", and rinse/wash/repeat. Rarely does spam make it into my inbox, but it's so much worse that messages I give a shit about are routinely dumped into my spam box. But not so routinely that I think to check it often enough...
- gjs278 4y ago
- 2000UltraDeluxe 4y ago
  That's the consequence of machine learning and allowing people to mark stuff as spam. 80% of all spam reports I get are for legitimate mails. A surprisingly large amount of them are people who mark their own mails as spam.
  - josephcsible 4y ago
    I don't think this is why. In my experience, when this happens, it's universally because the message failed at least one of SPF, DKIM, or DMARC.
    - theK 4y ago
      While these factors can cause a quarantine or even silent disposal, empirical evidence suggests that there are custom mechanisms (ie spam filters) downstream that do the larger part of the filtering. I have been running private Mail servers since the early 2000s and this last decade has certainly not been nice to folks that want to self host. I cannot even send my mother in law email because Google just plainly denies delivery with no way to circumvent. Funnily enough mass mailing from the same account 10000 other gmail addresses has delivery metrics just like doing it with mailchimp. I think it is safe to say that big email hosting has grown so complex internally that the companies themselves can’t really make sense of it any more. Edit: to preempt possible “you are doing it wrong” comments, my Mail server setup checks out in every conceivable test suite and email content as well :-)
beders 4y ago
What would it take to rescue email? What would need to happen to make it less annoying for you?
- tjpnz 4y ago
  I liked Bill Gates' idea of making senders pay a fee (perhaps a minimum amount specified by the recipient) and giving recipients the option of refunding it for personal contacts.
  - geoduck14 4y ago
    Ok. So. I'm not going to say that is a bad idea, but I will share a story. I used to work for a company that was the USPS's #1 or #2 customer (depending on the year). We spent a TON of money on spam. The biggest cost was the stamp. If people have to start paying for emails- it will eliminate a lot of the spam -but it won't eliminate all of the spam- and companies like the one I used to work for will start to shine.
    - JCharante 4y ago
      What if you are able to set your own fee, so before sending mail you lookup the difficulty level for the receiver. People can just keep raising the dificulty until they stop seeing spam.
    - yreg 4y ago
      People who deliver spam to my physical mail box IRL spend money on it and manage to fill it no problem. However, if they also had to pay me I would mind the spam a lot less.
  - paddez 4y ago
    This was the concept behind HashCash, the concept behind BitCoin/Cryptocurrencies in general. The idea being that each email would do a non-trivial amount of work, such compute a valid hash - encode it in the message header. This message header can be checked quickly on receivers side, but takes time for the sender. This makes sending a large amount of email quickly infeasible without a significant amount of compute power. https://en.wikipedia.org/wiki/Hashcash https://en.wikipedia.org/wiki/Hashcash
usr1106 4y ago
I have had the opposite problem for years. (Well, if it's a problem.) I have many Google accounts opened with disposable addresses, one for each service. (They are pretty old (10+ years) and to many of them I have lost access. I have the password, but Google does not let me in without providing a phone number first. Because I don't want to share my phone number every time I cannot register to any new Google services. But I guess that's only a good thing, the company has become too evil a long time ago.) All addresses get forwarded to my "main" gmail. And since the beginning of times all updates of terms and whatnot go to spam. I believe for phishing, not even for similar messages have been recognized as spam before. I mark them as not spam every time, but their filter just doesn't learn. Because I use disposable addresses everywhere I get very little spam. I close addresses that end up at a spammer. For me Gmail's filters produce at least 80% false positives. And marking messages as not spam seems to have little to no persistent impact.
- Agamus 4y ago
  You have described my own situation rather precisely.
kazinator 4y ago
> addressed to an address that isn't mine. This is because John was the envelope recipient: the one named in the SMTP protocol "RCPT to:" command. There are ways that a perfectly legitimate e-mail you receive night not mention any of your addresses in To: or Cc:. E.g. you are subscribed to a mailing list and some new posting (not part of some discussion you are in) arrives. It might just be addressed as "To: whatever-mailing-list@example.com". You received it because the mailing list robot used your e-mail as the RCPT to: envelope address at the SMTP protocol level.
- rchard2scout 4y ago
  Or because you're in the Bcc:
jdnordy 4y ago
I received the same email, just from a different domain: ARC-Authentication-Results: i=2; mx.google.com; dkim=pass header.i=@seiroowebizexpo.com header.s=jb54 header.b="l0E4c/Ut"; dkim=pass header.i=@youtube.com header.s=20210112 header.b=xGMHx3cn; arc=pass (i=1 spf=pass spfdomain=scoutcamp.bounces.google.com dkim=pass dkdomain=youtube.com dmarc=pass fromdomain=youtube.com); spf=pass (google.com: domain of support@seiroowebizexpo.com designates 2a01:7c8:aab3:2dc::8 as permitted sender) smtp.mailfrom=support@seiroowebizexpo.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=youtube.com Return-Path: <support@seiroowebizexpo.com> Received: from 8j.seiroowebizexpo.com (8j.seiroowebizexpo.com. [2a01:7c8:aab3:2dc::8])
throwaway892238 4y ago
Fun fact: sns.amazonaws.com has no DMARC record. Basically all alerts from AWS can be forged or end up in your spam folder and you have no way to know they really came from Amazon. You might say: oh, there's probably a good reason they don't have DMARC, right? Apparently the reason is it's a feature request that they haven't gotten to. And SNS has been around for 12 years. If I'm a hacker trying to phish someone into giving me their AWS creds, I'm faking CloudWatch alerts that say RDS is down and linking to my malware site. Because real CloudWatch alerts already end up in your spam folder (because no DKIM), no way to know if it's real or not unless you closely examine every link before clicking.
- orangepurple 4y ago
  DMARC is not a complete solution Many email clients don't preserve message integrity when mail is forwarded, which breaks DKIM as well as SPF. Mailing lists still alter message fields which break DKIM and they forward mail, which breaks SPF. Mailing list software is being brought up to date to deal with this, by adjusting the "From" header and re-signing the message with updated DKIM information. Many users are still not evaluating their email with an educated, critical eye. All the automated checking in the world still can't stop a user clicking on a message sent from "PayPa1" <no_really_this_is_paypal@hotmail.com>. SPF, DKIM, DMARC, and ARC at Fastmail: inbound mail Fastmail checks SPF, DKIM, DMARC, and ARC on all inbound mail. Passing or failing these checks only alters a message's spam score; we do not outright reject mail, only mark it as more or less suspicious. We add a standard Authentication Results header to all received mail explaining the results of the authentication checks. SPF, DKIM, DMARC, and ARC at Fastmail: outbound mail We publish a relaxed SPF policy and DKIM-sign all outbound mail from our domains. If you have a custom domain, you can set your SPF, DKIM and DMARC policy on your DNS screens. We have instructions if you host your DNS with us. If you use another DNS provider, you need to publish the correct records at your DNS provider. Fastmail domains have a DMARC policy of none, which means recipient mail servers should report whether the message passes or not, but not change deliverability. This allows users to send mail using our domains from anywhere, for legacy reasons. In the future we will publish a p=reject policy for our domains. This means to send with a From address at one of our domains, youʼll have to send through our servers. Any mail which passes through our system on the way to another provider will be ARC sealed with the authentication results when the mail was received. Longer blog post about this subject: https://fastmail.blog/advanced/spf-dkim-dmarc/ https://fastmail.blog/advanced/spf-dkim-dmarc/ https://www.fastmail.help/hc/en-us/articles/1500000280461-Sender-authentication https://www.fastmail.help/hc/en-us/articles/1500000280461-Se...
inopinatus 4y ago
The distinction between the envelope sender, and the From: header, is unfortunately lost on most people and ignored by many mail clients.
einpoklum 4y ago
> Gmail accepts forged YouTube emails Well, you shouldn't use GMail. They're mining your emails for information and occasionally passing them on to the US government, as Edward Snowden has revealed. There are other email providers, both free and for-pay, which should suit your needs well enough.
deleted 4y ago
[deleted]
Benjamin_Dobell 4y ago
Gmail / Google Workspaces don't care about their paying customer's privacy and are too lazy to improve their deliverability. Issues with inbound header handling wouldn't surprise me either. If you use multiple domains with Google Workspaces and noticed your emails not getting through when sent from your non-primary domain; you're not imagining it. Any mail receivers that are properly checking SPF are not going to give you a good deliverability score, no matter what you do. Gmail leaks your primary domain in the Reply-Path rather than specifying the domain you sent the email from. I've reported this to them, they don't give a shit. Fun.
- speleding 4y ago
  Yeah, there are reports of Gmail setting the Return-Path to the primary domain going back a decade ago. That makes the alternative domain pretty useless if you want to get SPF passing. Fastmail does the right thing FWIW, they switch the Return-Path to the alternative domain when you send from there.
md_ 4y ago
As other commenters noted, this doesn't seem to be a "forged" message at all; it's DKIM-signed by youtube.com. Probably whoever owns "alltimecaptaincool2019@gmail.com" has it forwarding to "robtoledoyour.com", who is then forwarding (with ARC!) to the author's Gmail mailbox. I don't see why this shouldn't work--there's nothing in DKIM, DMARC, or ARC which is intended to prevent forwarding of legitimate emails (and such a feature would annoy many users of email!). A well-functioning spam classifier knows that this email a) has a body that was signed by YouTube.com, b) was forwarded via robtoledoyour.com, and can make a spam classification decision based on that. Allowing the mail through seems reasonable given the contents are not spammy. I'm unclear on what a protocol--SMTP or anything else!--could do better here other than just not support forwarding mail at all (or require bidirectional approval before allowing forwarding), which would be hugely disruptive to existing email users.
- jmillikin 4y ago
  > I'm unclear on what a protocol--SMTP or anything else!--could do better > here other than just not support forwarding mail at all (or require > bidirectional approval before allowing forwarding) I think requiring approval would be the correct behavior. For <robtoledoyour.com> to be allowed to send email on behalf of <youtube.com> should require explicit permission in <youtube.com> DNS records (or similarly canonical location). As you note, this would break some of the remaining hold-outs who treat SMTP as an unauthenticated store-and-forward protocol. This seems both directionally correct, and aligned with how use of email has changed over the past ~20 years.
  - md_ 4y ago
    > I think requiring approval would be the correct behavior. For <robtoledoyour.com> to be allowed to send email on behalf of <youtube.com> should require explicit permission in <youtube.com> DNS records (or similarly canonical location). Sorry, by "bidirectional approval" I meant that the author's (i.e. recipient's) mailbox would somehow confirm its desire to receive mail forwarded by robtoledoyour.com. What you describe is, I think, impossible without eliminating certain extremely common use cases; it would break: * Mailing lists (which are the whole reason ARC exists); I don't want to have to approve lists.kernel.org to send arbitrary mail on behalf of me (and certainly not on behalf of gmail.com, which I don't control!); I want it to be able to forward mail that it promises came from me and for recipients to trust it only if they trust lists.kernel.org (which is how ARC works). * Mail forwarding between a user's different mailboxes; there's no way I can get Amazon.com to agree that myspambox@gmail.com should be allowed to forward mail on behalf of Amazon just so I can use a throwaway to forward mail to my main account. I can imagine configurations where everything works dramatically differently, but it's hard for me to see what's wrong with the status quo (a signed message, with ARC, etc) except that To headers are allowed to not match RCPT TO, which as others have noted is both a point of confusion for users and how BCC works, and thus a hard to eliminate feature.

296 points by jmillikin 4y ago

Could there be a Sender header that was being verified instead of the From? Is that how it works? What about envelope From? Which of those are even protected by DKIM/SPF?

actionablefiber 4y ago

Any ideas for why that email appeared in your inbox? It doesn't look like it's a phishing attack - "Updates to YouTube's Terms of Service" is a subject line that guarantees that precisely zero people will even bother opening it.

jessetemp 4y ago
Phishing bored lawyers?
RL_Quine 4y ago
An attempt at increasing reputation? Nobody is going to mark that as a spam.
- yreg 4y ago
  I'm sure many people will mark anything they are not interested in as spam.
  - hn_throwaway_69 4y ago
    My rule: If there isn't a prominent, 1-click unsubscribe link in an email, it gets marked as spam. If I click unsubscribe, and the form asks me to fill in information, it gets marked as spam. No, I'm not filling in my email, let alone completing a CAPTCHA, to ask you to stop sending me emails. However, I don't click an unsubscribe link in an email where I suspect the unsubscribe link is itself a scam to collect information.
    - RL_Quine 4y ago
      I've been toying with just automatically trashing any email that contains the string "unsubscribe", in any context.
- haruka_ff 4y ago
  This actually sounds like the most plausible reason considering there is really no other incentive to do this.
tiagod 4y ago
Perhaps to check if the inbox is valid? Sending from some random domain you risk having your mail silently dropped. If the server thinks you're youtube, then you're going to get through.
quickthrower2 4y ago
Close to zero, which is lots for a spammer.
- sodality2 4y ago
  Yes, but those likely to read ToS updates are not going to be the demographic that likely falls for scams; proper scammers target the population that is less adept at technology so they don't notice they're being duped.

tiagod 4y ago

This looks like a hint to why this message was accepted with failed dmarc: http://lists.dmarc.org/pipermail/dmarc-discuss/2013-April/001848.html http://lists.dmarc.org/pipermail/dmarc-discuss/2013-April/00...

RKearney 4y ago

The reason for this is right in the headers. The message had a valid ARC headers used to preserve DKIM/SPF/DMARC checks when forwarding email. https://en.wikipedia.org/wiki/Authenticated_Received_Chain https://en.wikipedia.org/wiki/Authenticated_Received_Chain

jeffbee 4y ago
Correct, this message isn't forged, it's authentic. You can check the signature yourself.
- gouggoug 4y ago
  > Correct, this message isn't forged, it's authentic I personally receive a lot of emails that aren't addressed to me and aren't marked as spam and have always wondered how this works. Can someone go into a bit more details about why this works? In what way is this message authentic? The ARC wiki page says "Validating an ARC chain only makes sense if the receiver trusts the ARC signers."; in this case the receiver is Gmail. Why does gmail trust a random domain (robtoledoyour.com)?
  - colbertw08 4y ago
    Yes I would love to know why this works as well. I've noticed over the past few months, I get emails that land in my gmail inbox that are obviously spam (various bs offers), and I've always wondered how they are able to bypass the spam filter with ease it seems. Also the To email line is to an email address that is a variation of my email address @aol.com that doesn't actually exist
    - XorNot 4y ago
      The latest thing that started happening a week or two ago was an endless stream of unsolicited mailing list messages addressed to "Prunella" trying to get me to click on links. Ended up just setting up an autodelete when that name is in the Send field (because I discovered Gmail doesn't let you auto-spam folder things).

ocdtrekkie 4y ago

On one hand, they aren't special casing their own products, so good on them I guess? On the other hand, if they can't detect this, what point is their spam filtering even? Public mail services can be surprisingly bad at what they decide not to catch. I love Fastmail but because some existing customers rely on it, the default behavior is not to block inbound emails with the same domain as you've delegated entirely to Fastmail. One would expect a given provider should, unless instructed explicitly otherwise, block outside emails from domains it controls mail for.

KennyBlanken 4y ago
> One would expect a given provider should, unless instructed explicitly otherwise, block outside emails from domains it controls mail for. It's not even something you need to specifically craft much infrastructure for. There are public standards for "don't accept email from this domain unless the sender has a cert encrypted by one of these CAs" (Google runs their own CA, yes?) and "don't accept email from this domain except from these servers" and so on.

Eridrus 4y ago

I'm not really an expert on this, so I don't know why someone is doing this here, but it sounds like a DKIM replay attack: https://proton.me/news/dkim-replay-attack-breakdown https://proton.me/news/dkim-replay-attack-breakdown

KennyBlanken 4y ago

Meanwhile, Gmail is obsessed with tagging messages I get from nearly every mailing list I'm on, including ones hosted by google groups, as spam. Even messages sent by a gmail user, to a google group. Outdoor groups? Spam. Technical mailing lists? Spam. Social group mailing lists? Spam. I have filters assigning these messages to labels. I have been on some of these lists for ten fucking years. I routinely go into my spam folder and find a dozen messages from these lists tagged as spam, dutifully click "not spam", and rinse/wash/repeat. Rarely does spam make it into my inbox, but it's so much worse that messages I give a shit about are routinely dumped into my spam box. But not so routinely that I think to check it often enough...

gjs278 4y ago
2000UltraDeluxe 4y ago
That's the consequence of machine learning and allowing people to mark stuff as spam. 80% of all spam reports I get are for legitimate mails. A surprisingly large amount of them are people who mark their own mails as spam.
- josephcsible 4y ago
  I don't think this is why. In my experience, when this happens, it's universally because the message failed at least one of SPF, DKIM, or DMARC.
  - theK 4y ago
    While these factors can cause a quarantine or even silent disposal, empirical evidence suggests that there are custom mechanisms (ie spam filters) downstream that do the larger part of the filtering. I have been running private Mail servers since the early 2000s and this last decade has certainly not been nice to folks that want to self host. I cannot even send my mother in law email because Google just plainly denies delivery with no way to circumvent. Funnily enough mass mailing from the same account 10000 other gmail addresses has delivery metrics just like doing it with mailchimp. I think it is safe to say that big email hosting has grown so complex internally that the companies themselves can’t really make sense of it any more. Edit: to preempt possible “you are doing it wrong” comments, my Mail server setup checks out in every conceivable test suite and email content as well :-)

beders 4y ago

What would it take to rescue email? What would need to happen to make it less annoying for you?

tjpnz 4y ago
I liked Bill Gates' idea of making senders pay a fee (perhaps a minimum amount specified by the recipient) and giving recipients the option of refunding it for personal contacts.
- geoduck14 4y ago
  Ok. So. I'm not going to say that is a bad idea, but I will share a story. I used to work for a company that was the USPS's #1 or #2 customer (depending on the year). We spent a TON of money on spam. The biggest cost was the stamp. If people have to start paying for emails- it will eliminate a lot of the spam -but it won't eliminate all of the spam- and companies like the one I used to work for will start to shine.
  - JCharante 4y ago
    What if you are able to set your own fee, so before sending mail you lookup the difficulty level for the receiver. People can just keep raising the dificulty until they stop seeing spam.
  - yreg 4y ago
    People who deliver spam to my physical mail box IRL spend money on it and manage to fill it no problem. However, if they also had to pay me I would mind the spam a lot less.
- paddez 4y ago
  This was the concept behind HashCash, the concept behind BitCoin/Cryptocurrencies in general. The idea being that each email would do a non-trivial amount of work, such compute a valid hash - encode it in the message header. This message header can be checked quickly on receivers side, but takes time for the sender. This makes sending a large amount of email quickly infeasible without a significant amount of compute power. https://en.wikipedia.org/wiki/Hashcash https://en.wikipedia.org/wiki/Hashcash

usr1106 4y ago

I have had the opposite problem for years. (Well, if it's a problem.) I have many Google accounts opened with disposable addresses, one for each service. (They are pretty old (10+ years) and to many of them I have lost access. I have the password, but Google does not let me in without providing a phone number first. Because I don't want to share my phone number every time I cannot register to any new Google services. But I guess that's only a good thing, the company has become too evil a long time ago.) All addresses get forwarded to my "main" gmail. And since the beginning of times all updates of terms and whatnot go to spam. I believe for phishing, not even for similar messages have been recognized as spam before. I mark them as not spam every time, but their filter just doesn't learn. Because I use disposable addresses everywhere I get very little spam. I close addresses that end up at a spammer. For me Gmail's filters produce at least 80% false positives. And marking messages as not spam seems to have little to no persistent impact.

Agamus 4y ago
You have described my own situation rather precisely.

kazinator 4y ago

> addressed to an address that isn't mine. This is because John was the envelope recipient: the one named in the SMTP protocol "RCPT to:" command. There are ways that a perfectly legitimate e-mail you receive night not mention any of your addresses in To: or Cc:. E.g. you are subscribed to a mailing list and some new posting (not part of some discussion you are in) arrives. It might just be addressed as "To: whatever-mailing-list@example.com". You received it because the mailing list robot used your e-mail as the RCPT to: envelope address at the SMTP protocol level.

rchard2scout 4y ago
Or because you're in the Bcc:

jdnordy 4y ago

I received the same email, just from a different domain: ARC-Authentication-Results: i=2; mx.google.com; dkim=pass header.i=@seiroowebizexpo.com header.s=jb54 header.b="l0E4c/Ut"; dkim=pass header.i=@youtube.com header.s=20210112 header.b=xGMHx3cn; arc=pass (i=1 spf=pass spfdomain=scoutcamp.bounces.google.com dkim=pass dkdomain=youtube.com dmarc=pass fromdomain=youtube.com); spf=pass (google.com: domain of support@seiroowebizexpo.com designates 2a01:7c8:aab3:2dc::8 as permitted sender) smtp.mailfrom=support@seiroowebizexpo.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=youtube.com Return-Path: <support@seiroowebizexpo.com> Received: from 8j.seiroowebizexpo.com (8j.seiroowebizexpo.com. [2a01:7c8:aab3:2dc::8])

throwaway892238 4y ago

Fun fact: sns.amazonaws.com has no DMARC record. Basically all alerts from AWS can be forged or end up in your spam folder and you have no way to know they really came from Amazon. You might say: oh, there's probably a good reason they don't have DMARC, right? Apparently the reason is it's a feature request that they haven't gotten to. And SNS has been around for 12 years. If I'm a hacker trying to phish someone into giving me their AWS creds, I'm faking CloudWatch alerts that say RDS is down and linking to my malware site. Because real CloudWatch alerts already end up in your spam folder (because no DKIM), no way to know if it's real or not unless you closely examine every link before clicking.

orangepurple 4y ago
DMARC is not a complete solution Many email clients don't preserve message integrity when mail is forwarded, which breaks DKIM as well as SPF. Mailing lists still alter message fields which break DKIM and they forward mail, which breaks SPF. Mailing list software is being brought up to date to deal with this, by adjusting the "From" header and re-signing the message with updated DKIM information. Many users are still not evaluating their email with an educated, critical eye. All the automated checking in the world still can't stop a user clicking on a message sent from "PayPa1" <no_really_this_is_paypal@hotmail.com>. SPF, DKIM, DMARC, and ARC at Fastmail: inbound mail Fastmail checks SPF, DKIM, DMARC, and ARC on all inbound mail. Passing or failing these checks only alters a message's spam score; we do not outright reject mail, only mark it as more or less suspicious. We add a standard Authentication Results header to all received mail explaining the results of the authentication checks. SPF, DKIM, DMARC, and ARC at Fastmail: outbound mail We publish a relaxed SPF policy and DKIM-sign all outbound mail from our domains. If you have a custom domain, you can set your SPF, DKIM and DMARC policy on your DNS screens. We have instructions if you host your DNS with us. If you use another DNS provider, you need to publish the correct records at your DNS provider. Fastmail domains have a DMARC policy of none, which means recipient mail servers should report whether the message passes or not, but not change deliverability. This allows users to send mail using our domains from anywhere, for legacy reasons. In the future we will publish a p=reject policy for our domains. This means to send with a From address at one of our domains, youʼll have to send through our servers. Any mail which passes through our system on the way to another provider will be ARC sealed with the authentication results when the mail was received. Longer blog post about this subject: https://fastmail.blog/advanced/spf-dkim-dmarc/ https://fastmail.blog/advanced/spf-dkim-dmarc/ https://www.fastmail.help/hc/en-us/articles/1500000280461-Sender-authentication https://www.fastmail.help/hc/en-us/articles/1500000280461-Se...

inopinatus 4y ago

The distinction between the envelope sender, and the From: header, is unfortunately lost on most people and ignored by many mail clients.

einpoklum 4y ago

> Gmail accepts forged YouTube emails Well, you shouldn't use GMail. They're mining your emails for information and occasionally passing them on to the US government, as Edward Snowden has revealed. There are other email providers, both free and for-pay, which should suit your needs well enough.

deleted 4y ago

[deleted]

Benjamin_Dobell 4y ago

Gmail / Google Workspaces don't care about their paying customer's privacy and are too lazy to improve their deliverability. Issues with inbound header handling wouldn't surprise me either. If you use multiple domains with Google Workspaces and noticed your emails not getting through when sent from your non-primary domain; you're not imagining it. Any mail receivers that are properly checking SPF are not going to give you a good deliverability score, no matter what you do. Gmail leaks your primary domain in the Reply-Path rather than specifying the domain you sent the email from. I've reported this to them, they don't give a shit. Fun.

speleding 4y ago
Yeah, there are reports of Gmail setting the Return-Path to the primary domain going back a decade ago. That makes the alternative domain pretty useless if you want to get SPF passing. Fastmail does the right thing FWIW, they switch the Return-Path to the alternative domain when you send from there.

md_ 4y ago

As other commenters noted, this doesn't seem to be a "forged" message at all; it's DKIM-signed by youtube.com. Probably whoever owns "alltimecaptaincool2019@gmail.com" has it forwarding to "robtoledoyour.com", who is then forwarding (with ARC!) to the author's Gmail mailbox. I don't see why this shouldn't work--there's nothing in DKIM, DMARC, or ARC which is intended to prevent forwarding of legitimate emails (and such a feature would annoy many users of email!). A well-functioning spam classifier knows that this email a) has a body that was signed by YouTube.com, b) was forwarded via robtoledoyour.com, and can make a spam classification decision based on that. Allowing the mail through seems reasonable given the contents are not spammy. I'm unclear on what a protocol--SMTP or anything else!--could do better here other than just not support forwarding mail at all (or require bidirectional approval before allowing forwarding), which would be hugely disruptive to existing email users.

jmillikin 4y ago
> I'm unclear on what a protocol--SMTP or anything else!--could do better > here other than just not support forwarding mail at all (or require > bidirectional approval before allowing forwarding) I think requiring approval would be the correct behavior. For <robtoledoyour.com> to be allowed to send email on behalf of <youtube.com> should require explicit permission in <youtube.com> DNS records (or similarly canonical location). As you note, this would break some of the remaining hold-outs who treat SMTP as an unauthenticated store-and-forward protocol. This seems both directionally correct, and aligned with how use of email has changed over the past ~20 years.
- md_ 4y ago
  > I think requiring approval would be the correct behavior. For <robtoledoyour.com> to be allowed to send email on behalf of <youtube.com> should require explicit permission in <youtube.com> DNS records (or similarly canonical location). Sorry, by "bidirectional approval" I meant that the author's (i.e. recipient's) mailbox would somehow confirm its desire to receive mail forwarded by robtoledoyour.com. What you describe is, I think, impossible without eliminating certain extremely common use cases; it would break: * Mailing lists (which are the whole reason ARC exists); I don't want to have to approve lists.kernel.org to send arbitrary mail on behalf of me (and certainly not on behalf of gmail.com, which I don't control!); I want it to be able to forward mail that it promises came from me and for recipients to trust it only if they trust lists.kernel.org (which is how ARC works). * Mail forwarding between a user's different mailboxes; there's no way I can get Amazon.com to agree that myspambox@gmail.com should be allowed to forward mail on behalf of Amazon just so I can use a throwaway to forward mail to my main account. I can imagine configurations where everything works dramatically differently, but it's hard for me to see what's wrong with the status quo (a signed message, with ARC, etc) except that To headers are allowed to not match RCPT TO, which as others have noted is both a point of confusion for users and how BCC works, and thus a hard to eliminate feature.