4 ms·

Fun fact: sns.amazonaws.com has no DMARC record. Basically all alerts from AWS can be forged or end up in your spam folder and you have no way to know they real

Fun fact: sns.amazonaws.com has no DMARC record. Basically all alerts from AWS can be forged or end up in your spam folder and you have no way to know they really came from Amazon. You might say: oh, there's probably a good reason they don't have DMARC, right? Apparently the reason is it's a feature request that they haven't gotten to. And SNS has been around for 12 years. If I'm a hacker trying to phish someone into giving me their AWS creds, I'm faking CloudWatch alerts that say RDS is down and linking to my malware site. Because real CloudWatch alerts already end up in your spam folder (because no DKIM), no way to know if it's real or not unless you closely examine every link before clicking.

orangepurple 4y ago
DMARC is not a complete solution Many email clients don't preserve message integrity when mail is forwarded, which breaks DKIM as well as SPF. Mailing lists still alter message fields which break DKIM and they forward mail, which breaks SPF. Mailing list software is being brought up to date to deal with this, by adjusting the "From" header and re-signing the message with updated DKIM information. Many users are still not evaluating their email with an educated, critical eye. All the automated checking in the world still can't stop a user clicking on a message sent from "PayPa1" <no_really_this_is_paypal@hotmail.com>. SPF, DKIM, DMARC, and ARC at Fastmail: inbound mail Fastmail checks SPF, DKIM, DMARC, and ARC on all inbound mail. Passing or failing these checks only alters a message's spam score; we do not outright reject mail, only mark it as more or less suspicious. We add a standard Authentication Results header to all received mail explaining the results of the authentication checks. SPF, DKIM, DMARC, and ARC at Fastmail: outbound mail We publish a relaxed SPF policy and DKIM-sign all outbound mail from our domains. If you have a custom domain, you can set your SPF, DKIM and DMARC policy on your DNS screens. We have instructions if you host your DNS with us. If you use another DNS provider, you need to publish the correct records at your DNS provider. Fastmail domains have a DMARC policy of none, which means recipient mail servers should report whether the message passes or not, but not change deliverability. This allows users to send mail using our domains from anywhere, for legacy reasons. In the future we will publish a p=reject policy for our domains. This means to send with a From address at one of our domains, youʼll have to send through our servers. Any mail which passes through our system on the way to another provider will be ARC sealed with the authentication results when the mail was received. Longer blog post about this subject: https://fastmail.blog/advanced/spf-dkim-dmarc/ https://fastmail.blog/advanced/spf-dkim-dmarc/ https://www.fastmail.help/hc/en-us/articles/1500000280461-Sender-authentication https://www.fastmail.help/hc/en-us/articles/1500000280461-Se...
- throwaway892238 4y ago
  DMARC is important if you want to create your own spam rules, such as "Send all e-mails from *.amazonaws.com that don't have valid DMARC to a Phishing folder". Sure, an attacker could use no-reply@sns.amazonaws.com.attacker.domain. But most of our users have been trained to briefly look at the From: address before clicking things, so those would not succeed often. Without DMARC, we can't even catch phishes of the real domain.
- RockRobotRock 4y ago
  I'm a satisfied Fastmail user, but it was down all day today for me :(
  - dx034 4y ago
    I haven't experienced any downtime, was that a regional issue?
    - orangepurple 4y ago
      There are a few problems but it works for me https://www.fastmailstatus.com/services/general https://www.fastmailstatus.com/services/general
    - RockRobotRock 4y ago
      Yes.
- dfee 4y ago
  This is going to sound funny, but is there a way to sign only certain emails (out of all emails a user sends) instead of signing all messages with DNS based verification? I should mention specifically in a way that’s at least decently user accessible; ruling out GPG.
  - azca 4y ago
    You can always sign based on specific rules via your MTA to sign some and not sign others. You can also send from many sender's (say allocated by spf allow rules) that aren't signed at all but matches the IP ranges allowed.
mise_en_place 4y ago
Why would you use SNS to send emails? That just seems really silly to me. It’s meant for pub-sub. I’d alert with PagerDuty or OpsGenie, so I’d not only get an email but a text or voice call.
- throwaway892238 4y ago
  SNS has two modes: A2A and A2P. A2A is pub-sub, A2P is for sending notifications to users (via e-mail, SMS, or mobile push) CloudWatch Alerts are sent from SNS, and I would imagine others are as well, although some may use SES. I think SES has the same issue, as the AWS docs only mention DMARC/DKIM in the context of a custom domain.
Avamander 4y ago
Fun fact, gmail.com's is p=none.

orangepurple 4y ago

DMARC is not a complete solution Many email clients don't preserve message integrity when mail is forwarded, which breaks DKIM as well as SPF. Mailing lists still alter message fields which break DKIM and they forward mail, which breaks SPF. Mailing list software is being brought up to date to deal with this, by adjusting the "From" header and re-signing the message with updated DKIM information. Many users are still not evaluating their email with an educated, critical eye. All the automated checking in the world still can't stop a user clicking on a message sent from "PayPa1" <no_really_this_is_paypal@hotmail.com>. SPF, DKIM, DMARC, and ARC at Fastmail: inbound mail Fastmail checks SPF, DKIM, DMARC, and ARC on all inbound mail. Passing or failing these checks only alters a message's spam score; we do not outright reject mail, only mark it as more or less suspicious. We add a standard Authentication Results header to all received mail explaining the results of the authentication checks. SPF, DKIM, DMARC, and ARC at Fastmail: outbound mail We publish a relaxed SPF policy and DKIM-sign all outbound mail from our domains. If you have a custom domain, you can set your SPF, DKIM and DMARC policy on your DNS screens. We have instructions if you host your DNS with us. If you use another DNS provider, you need to publish the correct records at your DNS provider. Fastmail domains have a DMARC policy of none, which means recipient mail servers should report whether the message passes or not, but not change deliverability. This allows users to send mail using our domains from anywhere, for legacy reasons. In the future we will publish a p=reject policy for our domains. This means to send with a From address at one of our domains, youʼll have to send through our servers. Any mail which passes through our system on the way to another provider will be ARC sealed with the authentication results when the mail was received. Longer blog post about this subject: https://fastmail.blog/advanced/spf-dkim-dmarc/ https://fastmail.blog/advanced/spf-dkim-dmarc/ https://www.fastmail.help/hc/en-us/articles/1500000280461-Sender-authentication https://www.fastmail.help/hc/en-us/articles/1500000280461-Se...

throwaway892238 4y ago
DMARC is important if you want to create your own spam rules, such as "Send all e-mails from *.amazonaws.com that don't have valid DMARC to a Phishing folder". Sure, an attacker could use no-reply@sns.amazonaws.com.attacker.domain. But most of our users have been trained to briefly look at the From: address before clicking things, so those would not succeed often. Without DMARC, we can't even catch phishes of the real domain.
RockRobotRock 4y ago
I'm a satisfied Fastmail user, but it was down all day today for me :(
- dx034 4y ago
  I haven't experienced any downtime, was that a regional issue?
  - orangepurple 4y ago
    There are a few problems but it works for me https://www.fastmailstatus.com/services/general https://www.fastmailstatus.com/services/general
  - RockRobotRock 4y ago
    Yes.
dfee 4y ago
This is going to sound funny, but is there a way to sign only certain emails (out of all emails a user sends) instead of signing all messages with DNS based verification? I should mention specifically in a way that’s at least decently user accessible; ruling out GPG.
- azca 4y ago
  You can always sign based on specific rules via your MTA to sign some and not sign others. You can also send from many sender's (say allocated by spf allow rules) that aren't signed at all but matches the IP ranges allowed.

mise_en_place 4y ago

Why would you use SNS to send emails? That just seems really silly to me. It’s meant for pub-sub. I’d alert with PagerDuty or OpsGenie, so I’d not only get an email but a text or voice call.

throwaway892238 4y ago
SNS has two modes: A2A and A2P. A2A is pub-sub, A2P is for sending notifications to users (via e-mail, SMS, or mobile push) CloudWatch Alerts are sent from SNS, and I would imagine others are as well, although some may use SES. I think SES has the same issue, as the AWS docs only mention DMARC/DKIM in the context of a custom domain.

Avamander 4y ago

Fun fact, gmail.com's is p=none.