3 ms·
> Adding to this, hard fail should be used with parked domains without exception. If a domain is not used for sending emails then it should have a null MX and h
by LeonM 4y ago
> Adding to this, hard fail should be used with parked domains without exception. If a domain is not used for sending emails then it should have a null MX and hard fail SPF stating not to trust any IP's or domains.
This is correct, but this is also mentioned in the article multiple times.
To add to that, a DMARC record with a "reject" policy is also recommended for domains that are not supposed to send any email, see also: https://www.mailhardener.com/kb/hardening-unused-domains https://www.mailhardener.com/kb/hardening-unused-domains
- LinuxBender 4y agoAlso null BIMI records as well, especially if one is going to use soft-fail. Or maybe a malware symbol.
- LeonM 4y ago> Also null BIMI records as well Could be useful, but a successful attack on BIMI would require: - Getting access to the DNS of the domain (in which case the null record will simply be replaced) - Obtaining a VMC for the domain, which should not be possible due to the extended validation requirement for a VMC (such as: phone validation) - Spending ~$800 on a VMC > especially if one is going to use soft-fail. As explained in the article, if DMARC is deployed then softfail is equal to (hard) fail. With DMARC anything that is not an SPF pass, is not aligned, thus a fail. The only exception here would be a very old legacy email system that doesn't support DMARC. But those will also not support BIMI anyway. > Or maybe a malware symbol. BIMI should always require a VMC. It should be impossible to obtain a VMC with a 'malware symbol'. Unless of course you are willing to pay a lot to get it registered as your company logo at your trademark office.