3 ms·

I think SPF+DKIM+DMARC has taken over most verification of email online already. I've had it setup with protonmail for a year now and it works very well, easil

I think SPF+DKIM+DMARC has taken over most verification of email online already. I've had it setup with protonmail for a year now and it works very well, easily automated with providers such as AWS route53 for example. So technically I could have hosted my own email that whole time, just replace the protonmail senders with my own. As long as I get a VPS IP without a tainted reputation.

dmw_ng 2y ago
SPF+DKIM+DMARC are a classic case of Goodhart's law, the amount of spam they stop these days (at least anecdotally) is minimal. Most spam I get seems to come via SalesForce infrastructure, and a variety of similar bulk email marketing providers
- PreInternet01 2y ago
  SPF definitely stops most 'stupid' spam (with the second-most valuable metric being EHLO-to-rDNS correspondence). Now, Salesforce and most other non-malicious transactional/list-based SaaSes present other challenges, mostly solved by applying SPF to their content From: header in addition to the SMTP 'mail from' address. This also involves promoting sender domains from 'DATA reject' to 'MAIL FROM reject' based on behavior, since most spammers see 'MAIL FROM accept' as a win, and won't check any further results.
- fullspectrumdev 2y ago
  Proper SPF/DKIM/DMARC at least prevents brand reputation abuse via spoofing (in many cases), which at least blocks a good amount of bullshit phishing and BEC efforts.
bawolff 2y ago
They kind of solve a different problem though - verifying that the email sender is really authorized for that domain. Nothing prevents spammers from setting up their own domain with valid spf, dkim, dmarc.
johnklos 2y ago
DNSBL are good to have in addition to checking SPF+DKIM+DMARC. This is because spammers now mass produce domains with valid SPF+DKIM+DMARC using Cloudflare and GoDaddy for domain registration, WHOIS and DNS because neither company gives the slightest care about abuse (and actively go out of their way to make reporting abuse arduous), and the source IPs could be anywhere in the world. One thing that does work to combat these SPF+DKIM+DMARC valid sources, I've found, is to reject all email from supposed email servers which either don't have working reverse DNS or which have reverse DNS which has a name that differs from the HELO / EHLO name. It used to be enough to just insist on working reverse DNS that has matching forward DNS resolution, but recently I've been testing requiring that "Return-Path" has the same domain as the HELO / EHLO. Another thing that I've noticed but I'm not sure how to check in sendmail is to reject email that has a "Return-Path", "From", "To", or "Reply-To" that's a Gmail address when the email isn't from Gmail. I'd like the same test with Outlook / Hotmail and Yahoo. I've found almost no instances of legitimate email sent this way. Many things to consider, now that SORBS is one less tool to use!

dmw_ng 2y ago

SPF+DKIM+DMARC are a classic case of Goodhart's law, the amount of spam they stop these days (at least anecdotally) is minimal. Most spam I get seems to come via SalesForce infrastructure, and a variety of similar bulk email marketing providers

PreInternet01 2y ago
SPF definitely stops most 'stupid' spam (with the second-most valuable metric being EHLO-to-rDNS correspondence). Now, Salesforce and most other non-malicious transactional/list-based SaaSes present other challenges, mostly solved by applying SPF to their content From: header in addition to the SMTP 'mail from' address. This also involves promoting sender domains from 'DATA reject' to 'MAIL FROM reject' based on behavior, since most spammers see 'MAIL FROM accept' as a win, and won't check any further results.
fullspectrumdev 2y ago
Proper SPF/DKIM/DMARC at least prevents brand reputation abuse via spoofing (in many cases), which at least blocks a good amount of bullshit phishing and BEC efforts.

bawolff 2y ago

They kind of solve a different problem though - verifying that the email sender is really authorized for that domain. Nothing prevents spammers from setting up their own domain with valid spf, dkim, dmarc.

johnklos 2y ago

DNSBL are good to have in addition to checking SPF+DKIM+DMARC. This is because spammers now mass produce domains with valid SPF+DKIM+DMARC using Cloudflare and GoDaddy for domain registration, WHOIS and DNS because neither company gives the slightest care about abuse (and actively go out of their way to make reporting abuse arduous), and the source IPs could be anywhere in the world. One thing that does work to combat these SPF+DKIM+DMARC valid sources, I've found, is to reject all email from supposed email servers which either don't have working reverse DNS or which have reverse DNS which has a name that differs from the HELO / EHLO name. It used to be enough to just insist on working reverse DNS that has matching forward DNS resolution, but recently I've been testing requiring that "Return-Path" has the same domain as the HELO / EHLO. Another thing that I've noticed but I'm not sure how to check in sendmail is to reject email that has a "Return-Path", "From", "To", or "Reply-To" that's a Gmail address when the email isn't from Gmail. I'd like the same test with Outlook / Hotmail and Yahoo. I've found almost no instances of legitimate email sent this way. Many things to consider, now that SORBS is one less tool to use!