11 ms·

Spammers are better at SPF, DKIM, and DMARC than everyone else

429 points by pabs3 2y ago

mbb70 2y ago
I'm sure regular airline passengers trip the metal detectors more often than terrorists, doesn't mean we should get rid of the metal detectors.
- citrin_ru 2y ago
  A better analogy would be a passport. It doesn’t stop all terrorists from boarding a plane at lest it stops already know to authorities ones (unless they have a passport on someone else’s name which is not easy).
  - b112 2y ago
    Or perhaps, why do you lock the door to your house? A few solid kicks will open most doors, the locks can be picked, someone can smash windows and enter, and many modern homes can be entered by ripping the wall open with a crowbar and axe. It's to stop midrange threats.
    - SXX 2y ago
      Doors and locks are purely social construct. For majority of people it's much easier to justify stealing from a porch compared to breaking in. No more, no less. For spammers on other hand it's just a business, there will be no reprecussions like ever and we know quite a few big and legitemate companies who started their path with marketing spam sometimes using leaked email databases.
      - b112 2y ago
        The way you're using "justify" here, makes it seem as if you think people feel it's morally legit to steal, if it's on a porch for... reasons?! From a moral perspective, theft is theft. There's no way someone can sanely claim they thought it was a free thing, because it wasn't locked away. Doors and locks are there to make theft harder, more overt, loud, etc, and by no means validate when it's legit to be a vile thief. Likewise, all spam is spam. The use of tools to make it more difficult for spammers to be spammers, is the same as having doors and locks. It makes it more difficult. edit: What I said was, you clained they tried to justify it. So no worries, I was not implicating you.
        SXX 2y ago
        I not trying to justify it, but if you actually look and check research about people who been caught stealing there is huge difference for them between stealing TV that dropped from a truck vs stealing from a porch vs stealing from inside the house even though it's the same TV. Theft is theft, but for monkey brains there is huge difference between stealing someone wallet from a pocket vs picking dropped wallet and not returning it. So my point is that doors and locks work not because it's good technical measures, but due to how average Joe percieve social construct about them. And for grey area activities online there is no such social construct because there is no percieved connection between bunch of email addresses and real people. Also in some countries it's totally legal to send you tons of physical mail spam.
  - iammrpayments 2y ago
    I forgot the name of this fallacy, I read about it in Nassim Taleb’s Antifragile a long time ago, but basically being wrong at spam won’t cause a lot of damage while being wrong once about a terrorist may cause thousands of deaths
csomar 2y ago
I am just having this problem. Actually getting SPF, DKIM and DMARC right and having a domain with a 0 spam score will still land you in the spam directory. It turns out, you need to have a "reputation"? before your email gets accepted into gmail. My head was spinning as to how that reputation will be built if your email just goes straight to spam. But sure, Linkedin emails are definitively not spam and their dark-patterns at adding you at n+1 emailing list doesn't get them banned from the big (or any?) provider.
- akimbostrawman 2y ago
  It's almost like all those bad actors (linkedin) are owned and controlled by the big players (microsoft) that benefit from email being only commodity they can provide.
- petemir 2y ago
  I worked on this for a while, at a time and in a market where most of our recipients had @hotmail addresses. I discovered that mass email sending was akin to a "pay-to-win" game. We had/opted to acquire the services of a company "expert in email deliverability" (Return Path), who somehow provided detailed metrics of how our IPs were scored by MSFT. I always wondered why MSFT didn't provide those scores by themselves, and how a 3rd. party could have access to them. Re. your comment... slow ramp-up is the only way, with constant monitoring of deliverability and consequent adjusting of recipients (i.e. removing those who do not open or hard-bounce). I did also wonder if paying that company perhaps gave us a headstart when adding new IPs...
  - b112 2y ago
    Turn on dmarc reporting. There are loads of tools to read the resulting xml.
- jeroenhd 2y ago
  It's easy, you just have to have a regular, decently sized volume of non-spam emails, and suddenly your email stops being marked as spam! The logic isn't even that bad. SPF and DKIM serve to prove to the email who the sender is. That doesn't mean much if the sender is a spammer. Verifying identity claims is only the first part in checking email for spam, the harder part is checking if that identity is someone you trust. When you email Outlook or Google, you're better sending more than a few every single day, and the recipient better manually drag those emails from their spam folders to their inbox, or they're all being learned as spam.
magicalhippo 2y ago
Moved my mail over to Proton and they had a very nice process that made it easy to add the required DNS entries and verify that they were correct. I was dreading this step as I hadn't done it before but turned out to be a breeze thanks to that.
- RamRodification 2y ago
  I think pretty much all email providers (and other systems that want to send on your behalf) have this. More or less the same process where they tell you what to add and then a "check my stuff" button to verify. Which is great.
  - magicalhippo 2y ago
    Sounds good. As I said it was my first time, and I'd just glossed over the specs and did not look forward to it (I usually don't enjoy sysadmin work). So, was just pleasantly surprised.
- jeroenhd 2y ago
  I think the problem isn't necessarily that adding DNS entries is hard (especially compared to the rest of the process of hosting your own email), but that getting a clear overview of what email tools an organization uses is difficult. You need IT to list all of the reporting tools, customer service to tell you about their support system, marketing to tell you about their mailing list tool of the week, the sales guys to warn you they're using this new AI email enhancer, and somehow get that shady email forwarding service the CEO uses to give up their mail server IP addresses. Then you need to figure out how to get coverage for all of those tools and keep on top of them whenever something changes. A lot of companies promise to do great things for you if you just enter the email address you'd like to send email from, and a lot of people gloss over the important details because those sound hard and when they tested the tool on their personal email it worked fine so that's probably unnecessary anyway! Managing email for a corporate domain can be like herding cats.
- theandrewbailey 2y ago
  I moved to Fastmail, and they have a nice guide to set up what's needed on DNS: https://www.fastmail.help/hc/en-us/articles/360060591153-Manual-DNS-configuration https://www.fastmail.help/hc/en-us/articles/360060591153-Man...
jeroenhd 2y ago
For me, as someone with their own mail server, these technologies mostly serve to inform me that Russian IP addresses are still trying to send email in the name of my domain for some stupid reason. It makes sense that people whose business is sending email know how to set up email correctly. I'm mostly surprised at how many legitimate sysadmins struggle with getting the basics correct. Surely those dozens of DMARC emails you get that your sendgrid email has been refused because of a bad SPF signature should set in motion some kind of plan to ask if maybe marketing is using them legitimately? Automated signatures are of limited value but I rarely see rejections based on SPF and DKIM that are a mistake. Things are probably worse for big organizations but as a small email server, technical rejections are usually the right call. The only exception is mailing lists, but the dozens of people who still use those can usually figure out how to add an exception for them.
- chillfox 2y ago
  In most organizations there is no point in a sysadmin to spend the effort in understanding how to set it up correctly as Marketing has got more authority on email. Marketing will simply demand changes to the config that they do not understand and there is nothing you can do to stop it as they will have the CEO on their side.
  - tomw1808 2y ago
    to be fair here: for a lot of companies, if the mass mailing stops, the money-flow stops then that's no good for anyone... so the CEO will probably err on the side of money, presumably.
    - snowwrestler 2y ago
      Why would properly configuring SPF, DKIM, and DMARC stop the mass mailing, though?
  - stef25 2y ago
    Marketing decides on DKIM and SPF ?
riobard 2y ago
The point of SPF/DKIM/DMARC is to bind emails to domains, so no more spoofing. It is naive to expect authentication alone can reduce spams.
- jeroenhd 2y ago
  To be fair, SPF saves mail.ru and outlook.com users from five, maybe six spam emails per month coming from my domain, based on DMARC reports. If those numbers scale to include every domain on the internet, that's a huge amount of spam being filtered out very easily and very early. You'd think spammers would've learned to avoid SPF domains at the very least but they haven't, so despite SPF/DMARC/DKIM failing to get anyone out the spam folder, the technology is still catching spam bots.
- fukawi2 2y ago
  Finally, a comment that understands the concepts instead of insolently ranting about how useless it is.
  - zeeZ 2y ago
    It feels similar to people conflating green https check marks in browsers and trustworthiness.
    - riobard 2y ago
      exactly!
- danaris 2y ago
  While it may or may not reduce spam, it has definitely (based on my personal experience) reduced the amount of spoofed phishing emails and backscatter spam emails to nearly nothing. In the early-to-mid '10s, before SPF/DKIM/DMARC became the law of the email land, one had to be much, much more careful with phishing emails, checking the wording, the logos, etc, because 9 out of 10 of them appeared to come from the actual domain the email purported to be from. In the past several years (I honestly don't know exactly when the change happened; I don't get a huge amount of phishing emails), it's shifted so that the first thing to check is the sender address. Usually that turns out to be some nonsense string @gmail.com or some long garbled domain.
badmintonbaseba 2y ago
Naively I thought that one value proposition of SPF, DKIM and DMARC is that reputation shifts from based on IP to be based on domain, once you set these up correctly. So as long as you can maintain a good reputation for your domain and have SPF, DKIM and DMARC correctly set up, then you can host your SMTP server at any IP and your emails will get delivered. I wonder why it doesn't work this way.
- arccy 2y ago
  domains are cheap and easy to get new ones. IPv4 addresses are limited so you can't burn them as freely.
  - dolmen 2y ago
    Do you imply that sending e-mail via IPv6 doesn't work?
- WhyNotHugo 2y ago
  IMHO, their main advantage is that third parties can’t send email which appears to originate from my domain. I configure my domain to use SPF, so now spammers can’t sign it properly. However, the fact that an email passes SPF verification only ensures that it was authorised by the domain owner. It doesn’t say anything about whether the domain owner is a spammer.
- dizhn 2y ago
  It does work like that except nobody actually knows Google or Microsoft's algorithms to allow or deny mail delivery. It's the whole SEO thing all over again.
- artee_49 2y ago
  It does work that way, but IP reputation is a thing as well so you need to keep that in mind. IPs need to be "seasoned" and "trusted" as well as domains. This is how email-as-infra works, you're sending from a shared pool of their ips and they sign your emails with DKIM and you'll have SPF set up as well on your own.
- 2y ago
apeters 2y ago
You may have success checking for common tracking and advertising elements in a mail. Good chance it's spam if there's not 100 trackers. Frustrating.
tomw1808 2y ago
Is there actually an "domain reputation as a service" provider, which controls a couple thousand gmail addresses, sends itself the emails and manually unmarks them as spam? Asking for a friend..........
chrismorgan 2y ago
Google are bad at SPF and DKIM. —⁂— 1. I tried responding to a Chromium bug tracker message by email a couple of months ago, and it failed me: > Unfortunately, your email to create/update an issue was not processed. > Reason: SPF/DKIM check failed. Please ensure your domain supports SPF (https://support.google.com/a/answer/178723 https://support.google.com/a/answer/178723) and DKIM (https://support.google.com/a/answer/174124 https://support.google.com/a/answer/174124). If your domain does not support them, please use the Google Issue Tracker UI (https://issuetracker.google.com https://issuetracker.google.com). Trouble is, this is simply not true. My SPF and DKIM are fine. This makes me wonder whether the email ingestion system is simply broken for everyone. —⁂— 2. I got involved in setting up a Google Workspace for someone a few months back, and the entire tool that their own documentation instructs you to use to check things, https://toolbox.googleapps.com/apps/checkmx/ https://toolbox.googleapps.com/apps/checkmx/, has been laughably broken for years, sometimes not working at all, but mostly producing misleading nonsense results (e.g. claiming domains have no mail server set up when they do). Then, to make it even more absurd, the feedback link they give you, https://toolbox.googleapps.com/apps/main/feedback?toolname=checkmx https://toolbox.googleapps.com/apps/main/feedback?toolname=c..., iframes https://docs.google.com/a/google.com/forms/d/e/1FAIpQLSdnlp8u_SE16oVwzog_hVa31EgPwXuqqeRkP9mFruqfegGG8Q/viewform?entry.1425347930=checkmx https://docs.google.com/a/google.com/forms/d/e/1FAIpQLSdnlp8..., but you haven’t been allowed to iframe such documents for I don’t know how long so it doesn’t load, and even if it did, it’s a private form that only Googlers, I suppose, can fill in. And there have been plenty of reports about all of this for years, and it’s still broken.
upofadown 2y ago
SPF/DKIM is really about mail server reputation. So it mostly benefits larger servers like the ones run by Google, Microsoft and Yahoo. Unfortunately, that means that attempts by those larger providers to combat spam using such reputation will naturally hurt smaller providers. So the actual effects of SPF/DKIM are on the whole negative. The root problem is that we don't actually need to keep track of email server reputation. No one says to themselves "Huh, this is from a Gmail address, it must be legit". We really want to keep track of sender reputation. We need to be able to treat anonymous email differently than email from people we actually know. That implies that we have some work to do on the problem of identity. As it is, there is not even a way for a known email sender to securely introduce an unknown email sender. You know, the way that regular human people normally are able to transfer identities from one to the other.
- jasode 2y ago
  >SPF/DKIM is really about mail server reputation. So it mostly benefits larger servers like the ones run by Google, Microsoft and Yahoo. Unfortunately, that means that attempts by those larger providers to combat span using such reputation will naturally hurt smaller providers. So the actual effects of SPF/DKIM are on the whole negative. That paragraph is incorrect. SPF/DKIM is not about reputation. The main purpose is preventing domain impersonation from unauthorized senders. E.g. mail servers will reject fake emails from "upofadown@microsoft.com" because you don't control any email servers that's whitelisted in microsoft.com DNS TXT records. E.g. I was able to register a brand new .com address and then successfully send to gmail and MS Outlook accounts within minutes because I had proper SPF/DKIM in the DNS records for that new domain. That new domain had zero reputation and yet Gmail accepted it because SPF/DKIM was configured correctly -- and -- the underlying ip address of the server it came from had a good reputation. If SPF/DKIM was truly about "reputation", it would mean I'd have to wait days or months for reputation history to build up before Gmail accepted it.
  - ghusto 2y ago
    And it will mysteriously _stop_ being able to send mail to Google despite you doing everything right, because of whatever nonsense they use to determine reputation.
cowfarts 2y ago
[dead]
bell-cot 2y ago
SPF, DKIM, DMARC, IP reputation, whitelists, blacklists, graylists, spam filters, ... https://xkcd.com/927/ https://xkcd.com/927/
- drpossum 2y ago
  ugh
kuon 2y ago
Providers should really stop using spam folder and refuse email at the session lvl, that alone would fix the false positive issue. I had a rant [1] about it a while ago. [1]: https://www.kuon.ch/post/2024-09-16-email-rant/ https://www.kuon.ch/post/2024-09-16-email-rant/
hannob 2y ago
This is missing the point. To be clear, I'm not necessarily a fan of DMARC, particularly how it was introduced. But it is very obvious that spammers will eventually do everything to not be flagged as spammers. What DMARC gives you is that it makes it less likely that your phishing mail will come from contact@yourbank.com. It will rather come from contact@y0urbank.com or some other domain. How much of an improvement that is and how many people will notice is certainly debatable. But that's what DMARC can give you. Nothing more, nothing less.
nubinetwork 2y ago
> Surely everyone (and by everyone I mean Google) is rejecting their mail? How do they not realize this? Not sending email to google helps.
nextn 2y ago
Spammers are worse at something no one tried to use AFAIK: require a fee to deliver email.
- Suzuran 2y ago
  You may be surprised to learn that spammers, being criminals, have no issue with stealing money from others to spend on email delivery fees. Edit: Proof-of-work "email postage" schemes are similarly doomed - The botnet that zero-day'd your mail servers does not care how much electricity they use.
  - carlosjobim 2y ago
    Criminals yes, criminal spammers no. If they could make money with other crime there would be no point in wasting their time with sending spam.
    - Suzuran 2y ago
      The point to sending the spam is to enable further crime. Do you really think they don't stand to profit from what they promote? Spam is a business like any other, they aren't going to magically disappear just because their advertising costs suddenly become non-zero. Just like how they found ways of shifting the costs of hosting mail servers onto others, they will find ways of shifting the costs of any "email postage" scheme onto others.
      - carlosjobim 2y ago
        This is very basic mathematics. If they have to do other crime to get their hands on the cash it would cost for them to spam, then why spam at all instead of only focusing on the other, more profitable crime? Spam by definition is mass messaging. If the price per message is higher than the expected return per message, it becomes pointless.
        Suzuran 2y ago
zzzeek 2y ago
I know very little about these protocols, except for having to deal with them a bit on those few sad occasions I need to get a server to send email. From those experiences I had a strong sense that Google pushes out all these complicated and difficult procedures on everyone just as a means of discouraging people from using email servers in the first place...."just use google, we control the whole thing anyway".
tgtaptarget 2y ago
[dead]
blitzar 2y ago
I have now sent messages to 3 companies that I am a customer of where their SPF, DKIM, and/or DMARC were failing - for things like initial signup emails. 3/3 responded. 2/3 told me to f'off.
- oynqr 2y ago
  Tell them to fix their shit, from their own address.
dathinab 2y ago
honestly my take away is the opposite we by far don't enforce them strict enough, because if we where people would make sure to get it right it's all a question about effort/turnout if you make it so that most times you mails still somehow end up with the user even if you mess them up there is much less insensitive for companies to fix their mail or force their provider to fix it so IMHO if all of SPF,DKIM and DMARC are not correct setup mails should just be directly discarded and not even delivered to spam while being more flexible was reasonable when this tech was new, that was 10 years ago. If being flexible mean that you also will sometime deliver outright cyber attacks like spear phishing and similar to your user and everyone had 10 years to fix their systems then there is really no reason to still be flexible. Also "scammers get it right so it's useless" is such a huge red hearing argument, yes they do get it right _for their domains_. It sill makes it harder (and if strictly enforced impossible, except if you give them permissions to do that*) for them to impersonate your domains. And yes that doesn't fix scammers from using their own domains, but it also was never intended to do so. Doing so is a very different problem one which probably needs some form of reputation system which isn't something you can just solve technically as it touches on a lot of subtle social political issues. Also given that all of the huge mail vendors have insensitive to use their "intern proprietary obscure" reputation system I don't expect there to be a technical solution provided/adopted tbh. (and yes SPF/DKIM/DMARC are all tech wise quite "meh", but we are kinda stuck with them, through that never was the issue IMHO, the issue is missing insensitive to bring the adoption up and missing insensitive for large mail providers to enforce it strictly) EDIT: PS: In one point they are fully right so, that is, with how things are you can't give SPF/DKIM/DMARC a large weight for calculating reputation. Also they where always only meant to tell you if someone can't be trusted, but never if someone can be trusted.
otabdeveloper4 2y ago
Mission accomplished. Nobody wants to solve the problem of spam, this is just theater to put another tax on the smaller players in the Internet industry business.
throw0101c 2y ago
Related: there are known problems with DKIM, and there's a DKIM2 effort: * https://datatracker.ietf.org/doc/draft-gondwana-dkim2-motivation/ https://datatracker.ietf.org/doc/draft-gondwana-dkim2-motiva... * https://datatracker.ietf.org/wg/dkim/about/ https://datatracker.ietf.org/wg/dkim/about/ * https://blog.redsift.com/email/dkim/first-look-at-dkim2-the-next-generation-of-dkim/ https://blog.redsift.com/email/dkim/first-look-at-dkim2-the-... The recently-held IETF 122 had a session on it: * https://www.youtube.com/watch?v=o-0OKfyLlBs https://www.youtube.com/watch?v=o-0OKfyLlBs
- kbolino 2y ago
  I'd also like to see an update to DMARC so you can require both SPF and DKIM in your policy, instead of just one out of the two.
  - Avamander 2y ago
    Terrible idea, SPF is very hostile to (legitimate) forwarding. In general SPF should actually die.
    - kbolino 2y ago
      If you have trusted forwarders, you just add them to the SPF policy (which can be recursive, though there is a pretty low limit on how many records can be looked up). I've not had an issue with this, personally. However, assuming DKIM can be tightened up as proposed above, I'm not sure SPF would be necessary anymore.
      - Avamander 2y ago
        There are quite a few problems with that. Biggest issue is that it would require the domain owner's explicit cooperation with each forwarder. It would also allow more than just forwarding existing letters. Real-life shows that SPF really doesn't work with forwarders and it probably never will.
cratermoon 2y ago
Of course they are. It's how they make their money. The big email providers generally don't make their money from selling email services, it's a thing they offer as an in to sell the services that do generate profits. On the other hand, successfully sending an email that bypasses both technical and human barriers is spammer's business.
artee_49 2y ago
DKIM is not meant to block spam, it's meant to authenticate that the sender had access to the private key for the public key exposed on the domain that it was sent from, implying that the sender has sufficient permissions to send from the domain. It should not be used to imply anything else, none of these have anything to do with spam, that's reputation (and yes, having DKIM set-up boosts your reputation but it is not sufficient) and should be "built" up by the domains sending the emails.
grayhatter 2y ago
No they're not. I run my own email server. Most spam crap cannot pass spf/dkim. Although this post has caused me to sit up and notice that the trendline is moving in the unfortunate direction, where I'd say 3 years ago the ones that pass were about 1/4, today it feels like 40-60% pass. The amount of mail I get that I expect, passes spf/dkim at around 90-95% I suspect the delta between their any my results are the very restrictive sender rules I have prior to accept. In addition any_address@domain goes to my default mailbox, so I'm also probably selecting for laziness a bit more than most. I also publish an email address without obfuscation on my site, which is getting very little spam, (near zero) which makes me wonder if most spam has given up on scraping the Internet for emails these days.
- indrora 2y ago
  It’s far easier to buy the email addresses of known good people by buying dumps of websites that got breached. Web scraping gets you a lot of fake emails, company sinkholes, and other low reward stuff. Paying $20 for 100k confirmed real emails with names? That’s gold.
Jzush 2y ago
My biggest problem with SPF, DKIM, DMARC is when you go to test this crap there's really only commercial apps. So people who are setting up things for a non-profit or a personal project are either forced to pay after doing 3 or 4 test emails or you wait like 24 hours or some crap. And all that just for the privilege of being able to send email to some gmail accounts. Trying to get email to properly encrypt is pulling teeth and yet I still get hundreds of thousands of spam a month on my gmail account. Any time I have to set up an email server on a new system I just kind of die a little.
- kro 2y ago
  Yopmail does verify and show these results for free when receiving a mail, this not even being their core feature
  - Jzush 2y ago
    That’s good to know. I’ve not seen it mentioned anywhere. The tools I’ve used in the past give me 3 or 4 test emails before they require me to sign up.
- toenail 2y ago
  I use https://www.mail-tester.com/ https://www.mail-tester.com/
  - andrew-jack 2y ago
    [dead]
- Avamander 2y ago
  You can always first send it to yourself and read the Authentication-Results header. Though even Gmail displays SPF/DKIM/DMARC status when you view the raw source of an email.
  - Jzush 2y ago
    Which works great unless you're trying to debug gmail refusing your emails because of some issue or another.
lisper 2y ago
I've been running my own spam filter for many years now based on this super-simple heuristic: My filter looks at my outgoing mail, and any mail received from an address I've sent mail to, or with a subject that has appeared in my outgoing mail (possibly with a "re:" prefix) is marked as non-spam. Everything else goes in spam, and any spam message from an address I've never received mail from before is marked as unread. I get hundreds of spams per day, but only about a dozen from new addresses. It takes me about ten seconds to scan them for non-spam cold calls, which are extremely rare. The other source of false positives is things like subscription confirmations, but because I know to expect those, they are always at the top of the spam folder. I put this initial system in place expecting to have to augment it later with a more traditional content-based filter, but this simple heuristic works so well I've never felt the need to implement that additional step.
- EGreg 2y ago
  Someone posted on X advice that really helped me clean up my inbox Add a filter looking for the word "Unsubscribe" and automatically put them in "Promotional" category or something similar. Also apply the filter to existing emails, and let it run for a minute. Try it now! And comment if it reduced your inbox to like 2% of what it was :)
  - ndriscoll 2y ago
    I've commented here before that it is obvious to me that gmail makes no effort to combat spam anymore given that unsubscribe links are legally required and generally present for spam in the US and are an obvious heuristic that aren't used. I would expect basically any trained filter to pick up on it, so my assumption is that they actually intentionally have rules to allow spam. I get emails that literally say "This is an email advertisement". These are presumably being blasted out to tons of mailboxes. How does a model not notice this?
    - lisper 2y ago
      A mail service run by an advertising company fails to filter out advertising emails? I'm shocked. Shocked!
johnklos 2y ago
Things have gone in the direction of being favorable for spammers. * WHOIS is effectively destroyed. * Companies like Cloudflare actively protect known spammers & scammers, and have made abuse reporting time consuming and error prone. * Consolidation of most email to several large players means filtering them causes problems. * Large delivery companies such as Sendgrid, Salesforce and Google basically do nothing about reported abuse. Yes, most spammers these days that set up their own domains have tools to make sure DKIM, SPF and DMARC are all good, but consider that we can't know anything about these spammers: TLS certificates no longer contain contact information, large providers don't provide useful WHOIS, don't forward abuse complaints, have no clue what an SOA record is, and so on. The way things should work is that we get a spam, we see the network from which the spam came through WHOIS, we forward the spam to their abuse address or the address they list in WHOIS, and we're done. The way things work is that they don't have working information in WHOIS, they ignore the abuse complaints, they act like they don't know what to do with it, or they reply with a form email saying to go and use a web page where it takes time and work to paste in each part of a spam. I blame the large companies who do this. Make reporting abuse difficult and you'll get much less reported abuse.
deng 2y ago
I observe the same thing. However, that does mean that SPF and DKIM are useless (although DMARC probably is). It is correct that SPF/DKIM does not really avoid spam, because spammers are not stupid and can read these standards like anyone else. However, before SPF/DKIM, I remember that I got a ton of phishing mails with FROM containing "support@paypal.com" or similar. Then came Bayes spam filtering, and that would move legitimate mail from Paypal to spam, because obviously, the phishing mails are quite similar. This problem has pretty much vanished, because Paypal clearly denotes which IP addresses are allowed to send mails from that domain via SPF and the client can verify the mail via DKIM. For instance, Spamassassin makes sure that mails with correct DKIM and from paypal.com get a massively reduced spam score so that your Bayes filter will not move it to spam. This is hardcoded for a lot of domains (see *welcomelist_dkim.cf).
GnarfGnarf 2y ago
Yeah, SPF, DKIM and DMARC are incomprehensible. The only people with the time, motivation and expertise to understand and apply them, are professional spammers. Most of the legitimate email I get, fail one or more of these tests. If I recall, SPF limits the number of domains you can enumerate in your DNS records.
alexjplant 2y ago
I used to run my own e-mail server for my personal address. In an attempt to reduce spam I configured Postfix to reject all inbound messages that weren't DKIM signed. The only time I ever had an issue was when somebody from the multinational publicly-traded company that I worked for tried to send a message to my personal inbox. They ran Exchange in the datacenter at the time (this would have been ~2017) and hadn't enabled DKIM signing. I had a friendly conversation with the sysadmin responsible for it and they had it enabled by the end of the week. I suppose the moral of the story is that it's possible to do billions of dollars in business a year without having textbook-perfect mail infrastructure. Hell, I ran a mail server with bad MX records, a missing PTR record, and a mismatched HELO header and the world kept spinning (when I was a literal child with nobody to tell me better - I've since learned the error of my ways).
add-sub-mul-div 2y ago
Just like spammers, scammers and other forms of predation will be better at crypto than everyone else, better at AI than everyone else, etc.
paul_h 2y ago
Rights of passage in sw-dev and IT is to propose a solution or re-implement something like many before you. Mine on email SPAM: https://paulhammant.com/blog/did-you-send-this https://paulhammant.com/blog/did-you-send-this
ahepp 2y ago
I have a much bigger issue with "legitimate" spam these days. Every service makes you give an email address, and they all force you to check a box allowing them to email you whatever they want. Then if they even have an "opt out" link, it takes you to a list of 500 different types of notifications and forces you to opt out of each one individually. Usually I will just disable the iCloud hide-my-email I used for a site, but sometimes there are legitimate emails mixed in with the stream of crap. I opted out of marketing emails from my credit card company, and now they instead send me emails asking me to re-evaluate my email preferences... It would be nice to see more done to fix this, but I guess it doesn't make anyone money. I guess I'll just have to use AI to filter signal from noise.
derangedHorse 2y ago
> Rejecting mail based solely on authentication failures of those deeply flawed authentication methods does more harm than good. How is DKIM "deeply flawed"?
RecycledEle 2y ago
I use NameCheap for domain registration, web hosting, and email. Unless I pay extra for Premium DNS, my DKIM is set wrong because their Web Hosting DNS does not oet me set it correctly.
lakomen 2y ago
[dead]
elzbardico 2y ago
It is incredible how the vast majority of the problems with the internet have their root cause in the activities of marketers.

429 points by pabs3 2y ago

I'm sure regular airline passengers trip the metal detectors more often than terrorists, doesn't mean we should get rid of the metal detectors.

citrin_ru 2y ago
A better analogy would be a passport. It doesn’t stop all terrorists from boarding a plane at lest it stops already know to authorities ones (unless they have a passport on someone else’s name which is not easy).
- b112 2y ago
  Or perhaps, why do you lock the door to your house? A few solid kicks will open most doors, the locks can be picked, someone can smash windows and enter, and many modern homes can be entered by ripping the wall open with a crowbar and axe. It's to stop midrange threats.
  - SXX 2y ago
    Doors and locks are purely social construct. For majority of people it's much easier to justify stealing from a porch compared to breaking in. No more, no less. For spammers on other hand it's just a business, there will be no reprecussions like ever and we know quite a few big and legitemate companies who started their path with marketing spam sometimes using leaked email databases.
    - b112 2y ago
      The way you're using "justify" here, makes it seem as if you think people feel it's morally legit to steal, if it's on a porch for... reasons?! From a moral perspective, theft is theft. There's no way someone can sanely claim they thought it was a free thing, because it wasn't locked away. Doors and locks are there to make theft harder, more overt, loud, etc, and by no means validate when it's legit to be a vile thief. Likewise, all spam is spam. The use of tools to make it more difficult for spammers to be spammers, is the same as having doors and locks. It makes it more difficult. edit: What I said was, you clained they tried to justify it. So no worries, I was not implicating you.
      - SXX 2y ago
        I not trying to justify it, but if you actually look and check research about people who been caught stealing there is huge difference for them between stealing TV that dropped from a truck vs stealing from a porch vs stealing from inside the house even though it's the same TV. Theft is theft, but for monkey brains there is huge difference between stealing someone wallet from a pocket vs picking dropped wallet and not returning it. So my point is that doors and locks work not because it's good technical measures, but due to how average Joe percieve social construct about them. And for grey area activities online there is no such social construct because there is no percieved connection between bunch of email addresses and real people. Also in some countries it's totally legal to send you tons of physical mail spam.
- iammrpayments 2y ago
  I forgot the name of this fallacy, I read about it in Nassim Taleb’s Antifragile a long time ago, but basically being wrong at spam won’t cause a lot of damage while being wrong once about a terrorist may cause thousands of deaths

csomar 2y ago

I am just having this problem. Actually getting SPF, DKIM and DMARC right and having a domain with a 0 spam score will still land you in the spam directory. It turns out, you need to have a "reputation"? before your email gets accepted into gmail. My head was spinning as to how that reputation will be built if your email just goes straight to spam. But sure, Linkedin emails are definitively not spam and their dark-patterns at adding you at n+1 emailing list doesn't get them banned from the big (or any?) provider.

akimbostrawman 2y ago
It's almost like all those bad actors (linkedin) are owned and controlled by the big players (microsoft) that benefit from email being only commodity they can provide.
petemir 2y ago
I worked on this for a while, at a time and in a market where most of our recipients had @hotmail addresses. I discovered that mass email sending was akin to a "pay-to-win" game. We had/opted to acquire the services of a company "expert in email deliverability" (Return Path), who somehow provided detailed metrics of how our IPs were scored by MSFT. I always wondered why MSFT didn't provide those scores by themselves, and how a 3rd. party could have access to them. Re. your comment... slow ramp-up is the only way, with constant monitoring of deliverability and consequent adjusting of recipients (i.e. removing those who do not open or hard-bounce). I did also wonder if paying that company perhaps gave us a headstart when adding new IPs...
- b112 2y ago
  Turn on dmarc reporting. There are loads of tools to read the resulting xml.
jeroenhd 2y ago
It's easy, you just have to have a regular, decently sized volume of non-spam emails, and suddenly your email stops being marked as spam! The logic isn't even that bad. SPF and DKIM serve to prove to the email who the sender is. That doesn't mean much if the sender is a spammer. Verifying identity claims is only the first part in checking email for spam, the harder part is checking if that identity is someone you trust. When you email Outlook or Google, you're better sending more than a few every single day, and the recipient better manually drag those emails from their spam folders to their inbox, or they're all being learned as spam.

magicalhippo 2y ago

Moved my mail over to Proton and they had a very nice process that made it easy to add the required DNS entries and verify that they were correct. I was dreading this step as I hadn't done it before but turned out to be a breeze thanks to that.

RamRodification 2y ago
I think pretty much all email providers (and other systems that want to send on your behalf) have this. More or less the same process where they tell you what to add and then a "check my stuff" button to verify. Which is great.
- magicalhippo 2y ago
  Sounds good. As I said it was my first time, and I'd just glossed over the specs and did not look forward to it (I usually don't enjoy sysadmin work). So, was just pleasantly surprised.
jeroenhd 2y ago
I think the problem isn't necessarily that adding DNS entries is hard (especially compared to the rest of the process of hosting your own email), but that getting a clear overview of what email tools an organization uses is difficult. You need IT to list all of the reporting tools, customer service to tell you about their support system, marketing to tell you about their mailing list tool of the week, the sales guys to warn you they're using this new AI email enhancer, and somehow get that shady email forwarding service the CEO uses to give up their mail server IP addresses. Then you need to figure out how to get coverage for all of those tools and keep on top of them whenever something changes. A lot of companies promise to do great things for you if you just enter the email address you'd like to send email from, and a lot of people gloss over the important details because those sound hard and when they tested the tool on their personal email it worked fine so that's probably unnecessary anyway! Managing email for a corporate domain can be like herding cats.
theandrewbailey 2y ago
I moved to Fastmail, and they have a nice guide to set up what's needed on DNS: https://www.fastmail.help/hc/en-us/articles/360060591153-Manual-DNS-configuration https://www.fastmail.help/hc/en-us/articles/360060591153-Man...

jeroenhd 2y ago

For me, as someone with their own mail server, these technologies mostly serve to inform me that Russian IP addresses are still trying to send email in the name of my domain for some stupid reason. It makes sense that people whose business is sending email know how to set up email correctly. I'm mostly surprised at how many legitimate sysadmins struggle with getting the basics correct. Surely those dozens of DMARC emails you get that your sendgrid email has been refused because of a bad SPF signature should set in motion some kind of plan to ask if maybe marketing is using them legitimately? Automated signatures are of limited value but I rarely see rejections based on SPF and DKIM that are a mistake. Things are probably worse for big organizations but as a small email server, technical rejections are usually the right call. The only exception is mailing lists, but the dozens of people who still use those can usually figure out how to add an exception for them.

chillfox 2y ago
In most organizations there is no point in a sysadmin to spend the effort in understanding how to set it up correctly as Marketing has got more authority on email. Marketing will simply demand changes to the config that they do not understand and there is nothing you can do to stop it as they will have the CEO on their side.
- tomw1808 2y ago
  to be fair here: for a lot of companies, if the mass mailing stops, the money-flow stops then that's no good for anyone... so the CEO will probably err on the side of money, presumably.
  - snowwrestler 2y ago
    Why would properly configuring SPF, DKIM, and DMARC stop the mass mailing, though?
- stef25 2y ago
  Marketing decides on DKIM and SPF ?

riobard 2y ago

The point of SPF/DKIM/DMARC is to bind emails to domains, so no more spoofing. It is naive to expect authentication alone can reduce spams.

jeroenhd 2y ago
To be fair, SPF saves mail.ru and outlook.com users from five, maybe six spam emails per month coming from my domain, based on DMARC reports. If those numbers scale to include every domain on the internet, that's a huge amount of spam being filtered out very easily and very early. You'd think spammers would've learned to avoid SPF domains at the very least but they haven't, so despite SPF/DMARC/DKIM failing to get anyone out the spam folder, the technology is still catching spam bots.
fukawi2 2y ago
Finally, a comment that understands the concepts instead of insolently ranting about how useless it is.
- zeeZ 2y ago
  It feels similar to people conflating green https check marks in browsers and trustworthiness.
  - riobard 2y ago
    exactly!
danaris 2y ago
While it may or may not reduce spam, it has definitely (based on my personal experience) reduced the amount of spoofed phishing emails and backscatter spam emails to nearly nothing. In the early-to-mid '10s, before SPF/DKIM/DMARC became the law of the email land, one had to be much, much more careful with phishing emails, checking the wording, the logos, etc, because 9 out of 10 of them appeared to come from the actual domain the email purported to be from. In the past several years (I honestly don't know exactly when the change happened; I don't get a huge amount of phishing emails), it's shifted so that the first thing to check is the sender address. Usually that turns out to be some nonsense string @gmail.com or some long garbled domain.

badmintonbaseba 2y ago

Naively I thought that one value proposition of SPF, DKIM and DMARC is that reputation shifts from based on IP to be based on domain, once you set these up correctly. So as long as you can maintain a good reputation for your domain and have SPF, DKIM and DMARC correctly set up, then you can host your SMTP server at any IP and your emails will get delivered. I wonder why it doesn't work this way.

arccy 2y ago
domains are cheap and easy to get new ones. IPv4 addresses are limited so you can't burn them as freely.
- dolmen 2y ago
  Do you imply that sending e-mail via IPv6 doesn't work?
WhyNotHugo 2y ago
IMHO, their main advantage is that third parties can’t send email which appears to originate from my domain. I configure my domain to use SPF, so now spammers can’t sign it properly. However, the fact that an email passes SPF verification only ensures that it was authorised by the domain owner. It doesn’t say anything about whether the domain owner is a spammer.
dizhn 2y ago
It does work like that except nobody actually knows Google or Microsoft's algorithms to allow or deny mail delivery. It's the whole SEO thing all over again.
artee_49 2y ago
It does work that way, but IP reputation is a thing as well so you need to keep that in mind. IPs need to be "seasoned" and "trusted" as well as domains. This is how email-as-infra works, you're sending from a shared pool of their ips and they sign your emails with DKIM and you'll have SPF set up as well on your own.
2y ago

apeters 2y ago

You may have success checking for common tracking and advertising elements in a mail. Good chance it's spam if there's not 100 trackers. Frustrating.

tomw1808 2y ago

Is there actually an "domain reputation as a service" provider, which controls a couple thousand gmail addresses, sends itself the emails and manually unmarks them as spam? Asking for a friend..........

chrismorgan 2y ago

Google are bad at SPF and DKIM. —⁂— 1. I tried responding to a Chromium bug tracker message by email a couple of months ago, and it failed me: > Unfortunately, your email to create/update an issue was not processed. > Reason: SPF/DKIM check failed. Please ensure your domain supports SPF (https://support.google.com/a/answer/178723 https://support.google.com/a/answer/178723) and DKIM (https://support.google.com/a/answer/174124 https://support.google.com/a/answer/174124). If your domain does not support them, please use the Google Issue Tracker UI (https://issuetracker.google.com https://issuetracker.google.com). Trouble is, this is simply not true. My SPF and DKIM are fine. This makes me wonder whether the email ingestion system is simply broken for everyone. —⁂— 2. I got involved in setting up a Google Workspace for someone a few months back, and the entire tool that their own documentation instructs you to use to check things, https://toolbox.googleapps.com/apps/checkmx/ https://toolbox.googleapps.com/apps/checkmx/, has been laughably broken for years, sometimes not working at all, but mostly producing misleading nonsense results (e.g. claiming domains have no mail server set up when they do). Then, to make it even more absurd, the feedback link they give you, https://toolbox.googleapps.com/apps/main/feedback?toolname=checkmx https://toolbox.googleapps.com/apps/main/feedback?toolname=c..., iframes https://docs.google.com/a/google.com/forms/d/e/1FAIpQLSdnlp8u_SE16oVwzog_hVa31EgPwXuqqeRkP9mFruqfegGG8Q/viewform?entry.1425347930=checkmx https://docs.google.com/a/google.com/forms/d/e/1FAIpQLSdnlp8..., but you haven’t been allowed to iframe such documents for I don’t know how long so it doesn’t load, and even if it did, it’s a private form that only Googlers, I suppose, can fill in. And there have been plenty of reports about all of this for years, and it’s still broken.

upofadown 2y ago

SPF/DKIM is really about mail server reputation. So it mostly benefits larger servers like the ones run by Google, Microsoft and Yahoo. Unfortunately, that means that attempts by those larger providers to combat spam using such reputation will naturally hurt smaller providers. So the actual effects of SPF/DKIM are on the whole negative. The root problem is that we don't actually need to keep track of email server reputation. No one says to themselves "Huh, this is from a Gmail address, it must be legit". We really want to keep track of sender reputation. We need to be able to treat anonymous email differently than email from people we actually know. That implies that we have some work to do on the problem of identity. As it is, there is not even a way for a known email sender to securely introduce an unknown email sender. You know, the way that regular human people normally are able to transfer identities from one to the other.

jasode 2y ago
>SPF/DKIM is really about mail server reputation. So it mostly benefits larger servers like the ones run by Google, Microsoft and Yahoo. Unfortunately, that means that attempts by those larger providers to combat span using such reputation will naturally hurt smaller providers. So the actual effects of SPF/DKIM are on the whole negative. That paragraph is incorrect. SPF/DKIM is not about reputation. The main purpose is preventing domain impersonation from unauthorized senders. E.g. mail servers will reject fake emails from "upofadown@microsoft.com" because you don't control any email servers that's whitelisted in microsoft.com DNS TXT records. E.g. I was able to register a brand new .com address and then successfully send to gmail and MS Outlook accounts within minutes because I had proper SPF/DKIM in the DNS records for that new domain. That new domain had zero reputation and yet Gmail accepted it because SPF/DKIM was configured correctly -- and -- the underlying ip address of the server it came from had a good reputation. If SPF/DKIM was truly about "reputation", it would mean I'd have to wait days or months for reputation history to build up before Gmail accepted it.
- ghusto 2y ago
  And it will mysteriously _stop_ being able to send mail to Google despite you doing everything right, because of whatever nonsense they use to determine reputation.

cowfarts 2y ago

[dead]

bell-cot 2y ago

SPF, DKIM, DMARC, IP reputation, whitelists, blacklists, graylists, spam filters, ... https://xkcd.com/927/ https://xkcd.com/927/

drpossum 2y ago
ugh

kuon 2y ago

Providers should really stop using spam folder and refuse email at the session lvl, that alone would fix the false positive issue. I had a rant [1] about it a while ago. [1]: https://www.kuon.ch/post/2024-09-16-email-rant/ https://www.kuon.ch/post/2024-09-16-email-rant/

hannob 2y ago

This is missing the point. To be clear, I'm not necessarily a fan of DMARC, particularly how it was introduced. But it is very obvious that spammers will eventually do everything to not be flagged as spammers. What DMARC gives you is that it makes it less likely that your phishing mail will come from contact@yourbank.com. It will rather come from contact@y0urbank.com or some other domain. How much of an improvement that is and how many people will notice is certainly debatable. But that's what DMARC can give you. Nothing more, nothing less.

nubinetwork 2y ago

> Surely everyone (and by everyone I mean Google) is rejecting their mail? How do they not realize this? Not sending email to google helps.

nextn 2y ago

Spammers are worse at something no one tried to use AFAIK: require a fee to deliver email.

Suzuran 2y ago
You may be surprised to learn that spammers, being criminals, have no issue with stealing money from others to spend on email delivery fees. Edit: Proof-of-work "email postage" schemes are similarly doomed - The botnet that zero-day'd your mail servers does not care how much electricity they use.
- carlosjobim 2y ago
  Criminals yes, criminal spammers no. If they could make money with other crime there would be no point in wasting their time with sending spam.
  - Suzuran 2y ago
    The point to sending the spam is to enable further crime. Do you really think they don't stand to profit from what they promote? Spam is a business like any other, they aren't going to magically disappear just because their advertising costs suddenly become non-zero. Just like how they found ways of shifting the costs of hosting mail servers onto others, they will find ways of shifting the costs of any "email postage" scheme onto others.
    - carlosjobim 2y ago
      This is very basic mathematics. If they have to do other crime to get their hands on the cash it would cost for them to spam, then why spam at all instead of only focusing on the other, more profitable crime? Spam by definition is mass messaging. If the price per message is higher than the expected return per message, it becomes pointless.
      - Suzuran 2y ago

zzzeek 2y ago

I know very little about these protocols, except for having to deal with them a bit on those few sad occasions I need to get a server to send email. From those experiences I had a strong sense that Google pushes out all these complicated and difficult procedures on everyone just as a means of discouraging people from using email servers in the first place...."just use google, we control the whole thing anyway".

tgtaptarget 2y ago

[dead]

blitzar 2y ago

I have now sent messages to 3 companies that I am a customer of where their SPF, DKIM, and/or DMARC were failing - for things like initial signup emails. 3/3 responded. 2/3 told me to f'off.

oynqr 2y ago
Tell them to fix their shit, from their own address.

dathinab 2y ago

honestly my take away is the opposite we by far don't enforce them strict enough, because if we where people would make sure to get it right it's all a question about effort/turnout if you make it so that most times you mails still somehow end up with the user even if you mess them up there is much less insensitive for companies to fix their mail or force their provider to fix it so IMHO if all of SPF,DKIM and DMARC are not correct setup mails should just be directly discarded and not even delivered to spam while being more flexible was reasonable when this tech was new, that was 10 years ago. If being flexible mean that you also will sometime deliver outright cyber attacks like spear phishing and similar to your user and everyone had 10 years to fix their systems then there is really no reason to still be flexible. Also "scammers get it right so it's useless" is such a huge red hearing argument, yes they do get it right _for their domains_. It sill makes it harder (and if strictly enforced impossible, except if you give them permissions to do that*) for them to impersonate your domains. And yes that doesn't fix scammers from using their own domains, but it also was never intended to do so. Doing so is a very different problem one which probably needs some form of reputation system which isn't something you can just solve technically as it touches on a lot of subtle social political issues. Also given that all of the huge mail vendors have insensitive to use their "intern proprietary obscure" reputation system I don't expect there to be a technical solution provided/adopted tbh. (and yes SPF/DKIM/DMARC are all tech wise quite "meh", but we are kinda stuck with them, through that never was the issue IMHO, the issue is missing insensitive to bring the adoption up and missing insensitive for large mail providers to enforce it strictly) EDIT: PS: In one point they are fully right so, that is, with how things are you can't give SPF/DKIM/DMARC a large weight for calculating reputation. Also they where always only meant to tell you if someone can't be trusted, but never if someone can be trusted.

otabdeveloper4 2y ago

Mission accomplished. Nobody wants to solve the problem of spam, this is just theater to put another tax on the smaller players in the Internet industry business.

throw0101c 2y ago

Related: there are known problems with DKIM, and there's a DKIM2 effort: * https://datatracker.ietf.org/doc/draft-gondwana-dkim2-motivation/ https://datatracker.ietf.org/doc/draft-gondwana-dkim2-motiva... * https://datatracker.ietf.org/wg/dkim/about/ https://datatracker.ietf.org/wg/dkim/about/ * https://blog.redsift.com/email/dkim/first-look-at-dkim2-the-next-generation-of-dkim/ https://blog.redsift.com/email/dkim/first-look-at-dkim2-the-... The recently-held IETF 122 had a session on it: * https://www.youtube.com/watch?v=o-0OKfyLlBs https://www.youtube.com/watch?v=o-0OKfyLlBs

kbolino 2y ago
I'd also like to see an update to DMARC so you can require both SPF and DKIM in your policy, instead of just one out of the two.
- Avamander 2y ago
  Terrible idea, SPF is very hostile to (legitimate) forwarding. In general SPF should actually die.
  - kbolino 2y ago
    If you have trusted forwarders, you just add them to the SPF policy (which can be recursive, though there is a pretty low limit on how many records can be looked up). I've not had an issue with this, personally. However, assuming DKIM can be tightened up as proposed above, I'm not sure SPF would be necessary anymore.
    - Avamander 2y ago
      There are quite a few problems with that. Biggest issue is that it would require the domain owner's explicit cooperation with each forwarder. It would also allow more than just forwarding existing letters. Real-life shows that SPF really doesn't work with forwarders and it probably never will.

cratermoon 2y ago

Of course they are. It's how they make their money. The big email providers generally don't make their money from selling email services, it's a thing they offer as an in to sell the services that do generate profits. On the other hand, successfully sending an email that bypasses both technical and human barriers is spammer's business.

artee_49 2y ago

DKIM is not meant to block spam, it's meant to authenticate that the sender had access to the private key for the public key exposed on the domain that it was sent from, implying that the sender has sufficient permissions to send from the domain. It should not be used to imply anything else, none of these have anything to do with spam, that's reputation (and yes, having DKIM set-up boosts your reputation but it is not sufficient) and should be "built" up by the domains sending the emails.

grayhatter 2y ago

No they're not. I run my own email server. Most spam crap cannot pass spf/dkim. Although this post has caused me to sit up and notice that the trendline is moving in the unfortunate direction, where I'd say 3 years ago the ones that pass were about 1/4, today it feels like 40-60% pass. The amount of mail I get that I expect, passes spf/dkim at around 90-95% I suspect the delta between their any my results are the very restrictive sender rules I have prior to accept. In addition any_address@domain goes to my default mailbox, so I'm also probably selecting for laziness a bit more than most. I also publish an email address without obfuscation on my site, which is getting very little spam, (near zero) which makes me wonder if most spam has given up on scraping the Internet for emails these days.

indrora 2y ago
It’s far easier to buy the email addresses of known good people by buying dumps of websites that got breached. Web scraping gets you a lot of fake emails, company sinkholes, and other low reward stuff. Paying $20 for 100k confirmed real emails with names? That’s gold.

Jzush 2y ago

My biggest problem with SPF, DKIM, DMARC is when you go to test this crap there's really only commercial apps. So people who are setting up things for a non-profit or a personal project are either forced to pay after doing 3 or 4 test emails or you wait like 24 hours or some crap. And all that just for the privilege of being able to send email to some gmail accounts. Trying to get email to properly encrypt is pulling teeth and yet I still get hundreds of thousands of spam a month on my gmail account. Any time I have to set up an email server on a new system I just kind of die a little.

kro 2y ago
Yopmail does verify and show these results for free when receiving a mail, this not even being their core feature
- Jzush 2y ago
  That’s good to know. I’ve not seen it mentioned anywhere. The tools I’ve used in the past give me 3 or 4 test emails before they require me to sign up.
toenail 2y ago
I use https://www.mail-tester.com/ https://www.mail-tester.com/
- andrew-jack 2y ago
  [dead]
Avamander 2y ago
You can always first send it to yourself and read the Authentication-Results header. Though even Gmail displays SPF/DKIM/DMARC status when you view the raw source of an email.
- Jzush 2y ago
  Which works great unless you're trying to debug gmail refusing your emails because of some issue or another.

lisper 2y ago

I've been running my own spam filter for many years now based on this super-simple heuristic: My filter looks at my outgoing mail, and any mail received from an address I've sent mail to, or with a subject that has appeared in my outgoing mail (possibly with a "re:" prefix) is marked as non-spam. Everything else goes in spam, and any spam message from an address I've never received mail from before is marked as unread. I get hundreds of spams per day, but only about a dozen from new addresses. It takes me about ten seconds to scan them for non-spam cold calls, which are extremely rare. The other source of false positives is things like subscription confirmations, but because I know to expect those, they are always at the top of the spam folder. I put this initial system in place expecting to have to augment it later with a more traditional content-based filter, but this simple heuristic works so well I've never felt the need to implement that additional step.

EGreg 2y ago
Someone posted on X advice that really helped me clean up my inbox Add a filter looking for the word "Unsubscribe" and automatically put them in "Promotional" category or something similar. Also apply the filter to existing emails, and let it run for a minute. Try it now! And comment if it reduced your inbox to like 2% of what it was :)
- ndriscoll 2y ago
  I've commented here before that it is obvious to me that gmail makes no effort to combat spam anymore given that unsubscribe links are legally required and generally present for spam in the US and are an obvious heuristic that aren't used. I would expect basically any trained filter to pick up on it, so my assumption is that they actually intentionally have rules to allow spam. I get emails that literally say "This is an email advertisement". These are presumably being blasted out to tons of mailboxes. How does a model not notice this?
  - lisper 2y ago
    A mail service run by an advertising company fails to filter out advertising emails? I'm shocked. Shocked!

johnklos 2y ago

Things have gone in the direction of being favorable for spammers. * WHOIS is effectively destroyed. * Companies like Cloudflare actively protect known spammers & scammers, and have made abuse reporting time consuming and error prone. * Consolidation of most email to several large players means filtering them causes problems. * Large delivery companies such as Sendgrid, Salesforce and Google basically do nothing about reported abuse. Yes, most spammers these days that set up their own domains have tools to make sure DKIM, SPF and DMARC are all good, but consider that we can't know anything about these spammers: TLS certificates no longer contain contact information, large providers don't provide useful WHOIS, don't forward abuse complaints, have no clue what an SOA record is, and so on. The way things should work is that we get a spam, we see the network from which the spam came through WHOIS, we forward the spam to their abuse address or the address they list in WHOIS, and we're done. The way things work is that they don't have working information in WHOIS, they ignore the abuse complaints, they act like they don't know what to do with it, or they reply with a form email saying to go and use a web page where it takes time and work to paste in each part of a spam. I blame the large companies who do this. Make reporting abuse difficult and you'll get much less reported abuse.

deng 2y ago

I observe the same thing. However, that does mean that SPF and DKIM are useless (although DMARC probably is). It is correct that SPF/DKIM does not really avoid spam, because spammers are not stupid and can read these standards like anyone else. However, before SPF/DKIM, I remember that I got a ton of phishing mails with FROM containing "support@paypal.com" or similar. Then came Bayes spam filtering, and that would move legitimate mail from Paypal to spam, because obviously, the phishing mails are quite similar. This problem has pretty much vanished, because Paypal clearly denotes which IP addresses are allowed to send mails from that domain via SPF and the client can verify the mail via DKIM. For instance, Spamassassin makes sure that mails with correct DKIM and from paypal.com get a massively reduced spam score so that your Bayes filter will not move it to spam. This is hardcoded for a lot of domains (see *welcomelist_dkim.cf).

GnarfGnarf 2y ago

Yeah, SPF, DKIM and DMARC are incomprehensible. The only people with the time, motivation and expertise to understand and apply them, are professional spammers. Most of the legitimate email I get, fail one or more of these tests. If I recall, SPF limits the number of domains you can enumerate in your DNS records.

alexjplant 2y ago

I used to run my own e-mail server for my personal address. In an attempt to reduce spam I configured Postfix to reject all inbound messages that weren't DKIM signed. The only time I ever had an issue was when somebody from the multinational publicly-traded company that I worked for tried to send a message to my personal inbox. They ran Exchange in the datacenter at the time (this would have been ~2017) and hadn't enabled DKIM signing. I had a friendly conversation with the sysadmin responsible for it and they had it enabled by the end of the week. I suppose the moral of the story is that it's possible to do billions of dollars in business a year without having textbook-perfect mail infrastructure. Hell, I ran a mail server with bad MX records, a missing PTR record, and a mismatched HELO header and the world kept spinning (when I was a literal child with nobody to tell me better - I've since learned the error of my ways).

add-sub-mul-div 2y ago

Just like spammers, scammers and other forms of predation will be better at crypto than everyone else, better at AI than everyone else, etc.

paul_h 2y ago

Rights of passage in sw-dev and IT is to propose a solution or re-implement something like many before you. Mine on email SPAM: https://paulhammant.com/blog/did-you-send-this https://paulhammant.com/blog/did-you-send-this

ahepp 2y ago

I have a much bigger issue with "legitimate" spam these days. Every service makes you give an email address, and they all force you to check a box allowing them to email you whatever they want. Then if they even have an "opt out" link, it takes you to a list of 500 different types of notifications and forces you to opt out of each one individually. Usually I will just disable the iCloud hide-my-email I used for a site, but sometimes there are legitimate emails mixed in with the stream of crap. I opted out of marketing emails from my credit card company, and now they instead send me emails asking me to re-evaluate my email preferences... It would be nice to see more done to fix this, but I guess it doesn't make anyone money. I guess I'll just have to use AI to filter signal from noise.

derangedHorse 2y ago

> Rejecting mail based solely on authentication failures of those deeply flawed authentication methods does more harm than good. How is DKIM "deeply flawed"?

RecycledEle 2y ago

I use NameCheap for domain registration, web hosting, and email. Unless I pay extra for Premium DNS, my DKIM is set wrong because their Web Hosting DNS does not oet me set it correctly.

lakomen 2y ago

[dead]

elzbardico 2y ago

It is incredible how the vast majority of the problems with the internet have their root cause in the activities of marketers.