3 ms·
DMARC is not a complete solution Many email clients don't preserve message integrity when mail is forwarded, which breaks DKIM as well as SPF. Mailing lists s
by orangepurple 4y ago
DMARC is not a complete solution
Many email clients don't preserve message integrity when mail is forwarded, which breaks DKIM as well as SPF.
Mailing lists still alter message fields which break DKIM and they forward mail, which breaks SPF. Mailing list software is being brought up to date to deal with this, by adjusting the "From" header and re-signing the message with updated DKIM information.
Many users are still not evaluating their email with an educated, critical eye. All the automated checking in the world still can't stop a user clicking on a message sent from "PayPa1" <no_really_this_is_paypal@hotmail.com>.
SPF, DKIM, DMARC, and ARC at Fastmail: inbound mail
Fastmail checks SPF, DKIM, DMARC, and ARC on all inbound mail. Passing or failing these checks only alters a message's spam score; we do not outright reject mail, only mark it as more or less suspicious. We add a standard Authentication Results header to all received mail explaining the results of the authentication checks.
SPF, DKIM, DMARC, and ARC at Fastmail: outbound mail
We publish a relaxed SPF policy and DKIM-sign all outbound mail from our domains.
If you have a custom domain, you can set your SPF, DKIM and DMARC policy on your DNS screens. We have instructions if you host your DNS with us. If you use another DNS provider, you need to publish the correct records at your DNS provider.
Fastmail domains have a DMARC policy of none, which means recipient mail servers should report whether the message passes or not, but not change deliverability. This allows users to send mail using our domains from anywhere, for legacy reasons.
In the future we will publish a p=reject policy for our domains. This means to send with a From address at one of our domains, youʼll have to send through our servers.
Any mail which passes through our system on the way to another provider will be ARC sealed with the authentication results when the mail was received.
Longer blog post about this subject: https://fastmail.blog/advanced/spf-dkim-dmarc/ https://fastmail.blog/advanced/spf-dkim-dmarc/
https://www.fastmail.help/hc/en-us/articles/1500000280461-Sender-authentication https://www.fastmail.help/hc/en-us/articles/1500000280461-Se...
- throwaway892238 4y agoDMARC is important if you want to create your own spam rules, such as "Send all e-mails from *.amazonaws.com that don't have valid DMARC to a Phishing folder". Sure, an attacker could use no-reply@sns.amazonaws.com.attacker.domain. But most of our users have been trained to briefly look at the From: address before clicking things, so those would not succeed often. Without DMARC, we can't even catch phishes of the real domain.
- RockRobotRock 4y agoI'm a satisfied Fastmail user, but it was down all day today for me :(
- dx034 4y agoI haven't experienced any downtime, was that a regional issue?
- orangepurple 4y agoThere are a few problems but it works for me https://www.fastmailstatus.com/services/general https://www.fastmailstatus.com/services/general
- RockRobotRock 4y agoYes.
- dfee 4y agoThis is going to sound funny, but is there a way to sign only certain emails (out of all emails a user sends) instead of signing all messages with DNS based verification? I should mention specifically in a way that’s at least decently user accessible; ruling out GPG.
- azca 4y agoYou can always sign based on specific rules via your MTA to sign some and not sign others. You can also send from many sender's (say allocated by spf allow rules) that aren't signed at all but matches the IP ranges allowed.