4 ms·

I use hard fail, because all of the problems described in the article are implementation (checking if mail from and from: are on the same domain/subdomain) and

I use hard fail, because all of the problems described in the article are implementation (checking if mail from and from: are on the same domain/subdomain) and idiocy (I've seen people forwarding mail to Google workspace hosted stuff by their own Mx without stripping or rewriting headers) problems. The second one is really dumb, and results in 99.999% of my dmarc reports rather than actual forged emails. All of these are solvable by anyone with a basic understanding of mail server operation. Soft fail is also pointless, if you can't manage SPF records then you have no business emitting mail, pay a competent professional. (As a side point, there are a lot of inaccuracies in the article but I expect the target audience is not me)

LeonM 4y ago
> (As a side point, there are a lot of inaccuracies in the article but I expect the target audience is not me) Could you elaborate on those?
pjkundert 4y ago
You cannot "strip off and rewrite" headers without destroying the email message's DKIM signature -- which is the primary assurance of authenticity of incoming email! Also, you are ensuring that emails from your domain can never reach anyone who has a "forwarding" email address (which is anyone managing any significant number of domains). These people use Cloudflare, etc. to manage the MX for these domains, and forwarding incoming email to their central email address (which remains hidden). You can't get away from email forwarding; its sort of baked into the underlying assumptions of SMTP, which you are unlikely to single-handedly defeat and replace with something better. In the mean time, email from your domain will appear "broken" to a vast multitude of the world's email-receiving population. Your domain, not theirs.
- throwaway67743 4y ago
  Yes, yes you can, that is exactly what you need to do to avoid DKIM failure, you've already broken the ability to verify anything by rewriting the destination. Also see: forwarding is broken (purely forwarding mail via SMTP is not the same as what the comment was about)
  - pjkundert 4y ago
    You don't "rewrite" the destination (the "To: <address>" header); you just forward the email along using another "RCPT TO: <address>". How do you propose that you "rewrite" headers without breaking DKIM? Any header included in the message's DKIM "h=to:from:... " stanza cannot be changed; they're included in the DKIM signature. You can simply textually include the entire original email in a completely NEW email message, that is DKIM-signed by your intermediate (forwarding) MTA -- but that's not "forwarding", at all -- that's just "sending an email". Is this what you're describing?

LeonM 4y ago

> (As a side point, there are a lot of inaccuracies in the article but I expect the target audience is not me) Could you elaborate on those?

pjkundert 4y ago

You cannot "strip off and rewrite" headers without destroying the email message's DKIM signature -- which is the primary assurance of authenticity of incoming email! Also, you are ensuring that emails from your domain can never reach anyone who has a "forwarding" email address (which is anyone managing any significant number of domains). These people use Cloudflare, etc. to manage the MX for these domains, and forwarding incoming email to their central email address (which remains hidden). You can't get away from email forwarding; its sort of baked into the underlying assumptions of SMTP, which you are unlikely to single-handedly defeat and replace with something better. In the mean time, email from your domain will appear "broken" to a vast multitude of the world's email-receiving population. Your domain, not theirs.

throwaway67743 4y ago
Yes, yes you can, that is exactly what you need to do to avoid DKIM failure, you've already broken the ability to verify anything by rewriting the destination. Also see: forwarding is broken (purely forwarding mail via SMTP is not the same as what the comment was about)
- pjkundert 4y ago
  You don't "rewrite" the destination (the "To: <address>" header); you just forward the email along using another "RCPT TO: <address>". How do you propose that you "rewrite" headers without breaking DKIM? Any header included in the message's DKIM "h=to:from:... " stanza cannot be changed; they're included in the DKIM signature. You can simply textually include the entire original email in a completely NEW email message, that is DKIM-signed by your intermediate (forwarding) MTA -- but that's not "forwarding", at all -- that's just "sending an email". Is this what you're describing?