4 ms·

DKIM and DMARC are not intended to address spam (a flood of low-quality commercial and scam emails). They are intended, along with SPF, to address impersonatio

DKIM and DMARC are not intended to address spam (a flood of low-quality commercial and scam emails). They are intended, along with SPF, to address impersonation, which is a distinct problem (although some spam does employ impersonation). They work just as well for minor email providers as they do for major ones. Even better, in some cases, because many small email providers are corporate IT departments, who tend to filter aggressively on those signals.

dspillett 3y ago
> * DKIM and DMARC are not intended to address spam […] They are intended, along with SPF, to address impersonation, which is a distinct problem (although some spam does employ impersonation). I would wager that the vast majority of true spam⁰ currently being sent, based on what my mail server sees, involves impersonation, because it is mostly messages that are not intended to be replied to by mail. You are in most cases instead told to go to a website or call a phone number if it is a “business opportunity” or to send money to a crypto-wallet in the case of a scam. This means that DKIM and SPF are increasingly effectively an anti-spam measure even if you argue that this is not their primary direct intent, because of the large overlap. I would argue that spam is one of their primary targets: junk mailers started faking addresses from real domains where they would otherwise have just included a completely fake address in response to recipient mail servers discarding mail that didn't appear to at least come from a valid domain. Some junk mail more deliberately uses impersonation, to convince the end recipient that it comes from the impersonated individual/group, but much of it does so just to convince the mail server to actually deliver the message. Yes, some genuine junk doesn't use impersonation (the hosting providers that buy mailing lists from other hosts as they close down, and other businesses doing the same, and damned recruiters, for two examples) – but not the majority IME. -- [0] In “true” spam, I'm discounting newsletters and mailing lists that people forgot they signed up for, or signed up for to get a discount but don't really want, etc.

dspillett 3y ago

> * DKIM and DMARC are not intended to address spam […] They are intended, along with SPF, to address impersonation, which is a distinct problem (although some spam does employ impersonation). I would wager that the vast majority of true spam⁰ currently being sent, based on what my mail server sees, involves impersonation, because it is mostly messages that are not intended to be replied to by mail. You are in most cases instead told to go to a website or call a phone number if it is a “business opportunity” or to send money to a crypto-wallet in the case of a scam. This means that DKIM and SPF are increasingly effectively an anti-spam measure even if you argue that this is not their primary direct intent, because of the large overlap. I would argue that spam is one of their primary targets: junk mailers started faking addresses from real domains where they would otherwise have just included a completely fake address in response to recipient mail servers discarding mail that didn't appear to at least come from a valid domain. Some junk mail more deliberately uses impersonation, to convince the end recipient that it comes from the impersonated individual/group, but much of it does so just to convince the mail server to actually deliver the message. Yes, some genuine junk doesn't use impersonation (the hosting providers that buy mailing lists from other hosts as they close down, and other businesses doing the same, and damned recruiters, for two examples) – but not the majority IME. -- [0] In “true” spam, I'm discounting newsletters and mailing lists that people forgot they signed up for, or signed up for to get a discount but don't really want, etc.