3 ms·

I can't send mail to mit.edu addresses. It gets rejected with a message that says I should talk to Microsoft. I frequently end up in GMail's spam folders. No i

by dsr_ 4y ago

I can't send mail to mit.edu addresses. It gets rejected with a message that says I should talk to Microsoft. I frequently end up in GMail's spam folders. No idea why. I see no more than one piece of 'spam' a week; everything else is caught by a combination of a 15 minute greylist, the zen spamhaus BL, and SpamAssassin evaluating things. There are a bunch of spammers who send from accounts with valid SPF and DKIM, by the way. Spam is a reasonably solved problem, but SPF and DKIM aren't much help. (I get lots and lots of business spam, where the sender clearly believes that they have a right to try to sell me crap. The difference is that if I respond to business spam, someone will answer, trying to sell me crap.)

rsyring 4y ago
SPF/DKIM are not intended to prevent people from sending spam. They are intended to let a domain owner tell other email providers what servers have the right to send email from that domain (and sign email). I can send email all day from joboffers@google.com. But most email providers will check SPF and see that my VPS IP is not authorized by google.com to send email, and it will go to spam. Those standards wouldn't keep me from registering example.com, setting up SPF correctly, and then spamming. There are other techniques to filter out that kind of behavior.
- Symbiote 4y ago
  > I can send email all day from joboffers@google.com. But most email providers will check SPF and see that my VPS IP is not authorized by google.com to send email, and it will go to spam. Actually, it will be discarded completely. Google's DMARC policy is for mail from unrecognized origins to be rejected: host -t txt _dmarc.google.com _dmarc.google.com descriptive text "v=DMARC1; p=reject; rua=mailto:mailauth-reports@google.com" p=quarantine would send it to spam.
massaman_yams 4y ago
I might be reading into this a little, but you seem to be arguing that "Spam is a reasonably solved problem at my scale, therefore spam is a reasonably solved problem at global scale", and those are very different things. One of the key differences is: a small domain like yours is multiple orders of magnitude less attractive of a target, vs. Gmail, and as a result Gmail's filters are subject to constant, high-volume adversarial attacks, and you are not. SPF and DKIM are pretty explicit in their RFCs that passing authentication isn't a sign the mail is legitimate. The presence of passing auth in a message does change how filters should handle it, but for most larger-scale production filtering systems (not spamassassin) that mostly ends up as "change the weight of certain reputation identifiers in the spam filtering inputs", more or less.

by dsr_ 4y ago

rsyring 4y ago

SPF/DKIM are not intended to prevent people from sending spam. They are intended to let a domain owner tell other email providers what servers have the right to send email from that domain (and sign email). I can send email all day from joboffers@google.com. But most email providers will check SPF and see that my VPS IP is not authorized by google.com to send email, and it will go to spam. Those standards wouldn't keep me from registering example.com, setting up SPF correctly, and then spamming. There are other techniques to filter out that kind of behavior.

Symbiote 4y ago
> I can send email all day from joboffers@google.com. But most email providers will check SPF and see that my VPS IP is not authorized by google.com to send email, and it will go to spam. Actually, it will be discarded completely. Google's DMARC policy is for mail from unrecognized origins to be rejected: host -t txt _dmarc.google.com _dmarc.google.com descriptive text "v=DMARC1; p=reject; rua=mailto:mailauth-reports@google.com" p=quarantine would send it to spam.

massaman_yams 4y ago

I might be reading into this a little, but you seem to be arguing that "Spam is a reasonably solved problem at my scale, therefore spam is a reasonably solved problem at global scale", and those are very different things. One of the key differences is: a small domain like yours is multiple orders of magnitude less attractive of a target, vs. Gmail, and as a result Gmail's filters are subject to constant, high-volume adversarial attacks, and you are not. SPF and DKIM are pretty explicit in their RFCs that passing authentication isn't a sign the mail is legitimate. The presence of passing auth in a message does change how filters should handle it, but for most larger-scale production filtering systems (not spamassassin) that mostly ends up as "change the weight of certain reputation identifiers in the spam filtering inputs", more or less.