7 ms·

For me, as someone with their own mail server, these technologies mostly serve to inform me that Russian IP addresses are still trying to send email in the name

• chillfox 2y ago
  In most organizations there is no point in a sysadmin to spend the effort in understanding how to set it up correctly as Marketing has got more authority on email. Marketing will simply demand changes to the config that they do not understand and there is nothing you can do to stop it as they will have the CEO on their side.
  • tomw1808 2y ago
    to be fair here: for a lot of companies, if the mass mailing stops, the money-flow stops then that's no good for anyone... so the CEO will probably err on the side of money, presumably.
    • snowwrestler 2y ago
      Why would properly configuring SPF, DKIM, and DMARC stop the mass mailing, though?
  • stef25 2y ago
    Marketing decides on DKIM and SPF ?
    • selykg 2y ago
      The problem I personally ran into as a one person IT department was that the VP of marketing had more power over me, as a manager, and that meant more to my supervisor (the CEO) than me fighting to do things as correctly as possible. I was seen as a roadblock or speed bump. So, they may not decide on DKIM and SPF, but if marketing isn’t happy then their negativity could cause push back that forces changes that may technically not be good for the company. I’ve abandoned that role and have gone back to an IC role and I’m much happier for it.
      • seer 2y ago
        As long as you're not breaking the law / hurting people, does the struggle really matter? The best way I've been able to make people listen to me is by just presenting them with options and results. If you do it this hacky way - we run this risk and this bad thing can happen etc. After a few times they see the consequence of their decisions people start paying attention to you. Do it a few more and now the company will have an "institutional knowledge" that you are usually right, and even if the manager leave, you still end up like the go-to guy on how to ship. And sometimes the marketing people might end up being correct! I've once actually battled to "do the correct thing" (way back in the day it was a ruby on rails modeling I think) and the product owner was like - just do it this hacky way I don't care ... I did it the hacky way and you know what - it was the right call - we never changed it again and the business knowledge we got from it was actually valuable.
        • selykg 2y ago
          In the end, for me personally, I give people respect for their roles and the benefit of the doubt that they're in the position for the right reasons. But when I don't get that kind of thing in return then it just pisses me off. What I realized along the way is that I don't want to be in charge of things like this, it's simply not for me, at the very least it isn't on that team. Maybe that will change with the right people but the whole thing soured me on management in general and I will avoid it like the plague. I'm pretty bitter about it all still, but it's a combination of a lot of things beyond this particular bit I shared. All I can say is I'm glad I am no longer in that role, it was slowly killing me.
  • tigeroil 2y ago
    You mean like the time I had a salesperson demanding that we turn off Cloudflare across our entire domain because he'd read some random article somewhere saying we should?
    • ipaddr 2y ago
      The goal of sales isn't to block upto a 1/3 of world wide traffic. Turning off Cloudfare means more traffic and more sales are not blocked. Did you even read the article or did you dismiss it because it came from 'sales'.
      • deleted 2y ago
        [deleted]
      • pixl97 2y ago
        Sales: "look, I turned this off and sales went way up" Security: "We had to cancel every single one of those sales because they came from stolen credit cards. It's costing us more to deal with that then we are earning"
        • izacus 2y ago
          Accounting: "We're measuring a pretty big loss because security cancelled legitimate purchases together with fake ones and now clients are leaving."
  • jeroenhd 2y ago
    Which is another reason to strictly enforce SPF and DKIM, in my book. Let marketing break those policies, that way I don't need to bother with reading your company's spam!
  • throw0101c 2y ago
    > Marketing will simply demand changes to the config that they do not understand and there is nothing you can do to stop it as they will have the CEO on their side. Marketing should get their own (sub)domain for sending their missives, that way the primary corporate domain's reputation is not harmed. Unless you want to run the risk of outgoing e-mails from Finance / Accounts Receivable to be sent to other companies' Junk folder.
    • nkrisc 2y ago
      It's amusing to see this advice in this thread contrasted with the recent Troy Hunt phishing attack thread where folks are complaining about companies like Microsoft having dozens of varying domain names.
      • throw0101c 2y ago
        > […] about companies like Microsoft having dozens of varying domain names. There's a difference between one and dozens, and even between one dozen and dozens. Most companies are not of Microsoft's size either: just having news.example.com would probably be sufficient for a lot places.
    • rchaud 2y ago
      This is email marketing 101, HN'ers are massively overstating how many domains are getting blacklisted because of "marketing".
  • jabroni_salad 2y ago
    Orgs like that will hire consultants like me when they can't figure out why their stuff isn't landing in the inbox. Then 3 months later their webdev will somehow delete the entire zone when adding their A record.
  • JohnMakin 2y ago
    even worse when you have even less control than that, if you run some type of hosting and are trying to convince non-technical clients (or even worse, non technical clients who think they are technical) to “please just add this record exactly as it says here to your domain” and they’re somehow unable to for months and months
    • WarOnPrivacy 2y ago
      > "please just add this record exactly as it says here to your domain" and they’re somehow unable to for months and months I ran into this helping a friend whose biz emails to gmail recipients were getting dropped; the IT dept of the umbrella corp wouldn't respond. Same to me when I sent the correct DMARC, SPF etc. (My friend's biz was his own but it shared some resources with a larger corp.) I eventually realized that the (wrong) DMARC reporting domain wasn't even registered. I did what you'd expect and I soon had DMARC reports for subsidiaries of the umbrella corp. My friend passed that up to the CEO and suddenly IT was responsive. In the end, it turned out that IT was deliberately blocking his biz emails to his biz family members. After 10 years they suddenly decided that email to family+gmail was risky and that they were going to gaslight my friend about it. Because reasons.
      • JohnMakin 2y ago
        That’s a wild story, thanks for sharing - I find interfacing with external IT teams extraordinarily frustrating. I suspect it’s because businesses often don’t manage their IT teams well or have a good process to expedite business -> IT requests that really should be super easy and provide a lot of tangible value for the amount of comparative effort involved. I’ve run into outright malicious stuff internally like this, but never externally - I would probably go apoplectic if I was your friend
• csomar 2y ago
  > that Russian IP addresses are still trying to send email in the name of my domain for some stupid reason You can set your policy to reject, that will deter the Russians from using your domain.
  • jeroenhd 2y ago
    I used to have my policy set to reject, but then I found out some part of an Enterprise Outlook mail filtering chain was rewriting the mail I sent before checking the DKIM signature. I can't fix stupid, especially for other parties, so I changed the policy to quarantine instead. I doubt Russian spammers will care about the difference to be honest. If they accept that their email will be delivered to spam folders, why would they care that the email gets silently dropped? In neither case anyone is going to fall for them.
    • csomar 2y ago
      Because Spam has a non-zero CTR while rejected mail CTR is exactly 0.
• JumpCrisscross 2y ago
  > Russian IP addresses are still trying to send email in the name of my domain for some stupid reason For what it's worth, I've started seeing cybersecurity insurers requiring riders and extra payments if you don't block Russian IPs.
  • CableNinja 2y ago
    Ive got a server hosting a number of things, amd monitoring setup for a lot of stats. Got tired of seeing blips because various countries were beating on my server, not a DoS, but enough requests to notice, and sometimes generate an alert. I blocked 7 countries, in full, and the impact was fantastic. No more 2gb of logs generated every day by countries that have no business accessing my server. Unless you own a global business, i see no reason to even allow other countries access. The potential for attacks is too great, especially from some very specific countries.
    • JumpCrisscross 2y ago
      > I blocked 7 countries Russia, China, Nigeria, Romania, North Korea, Iran and Belarus [1]? [1] https://www.ox.ac.uk/news/2024-04-10-world-first-cybercrime-index-ranks-countries-cybercrime-threat-level https://www.ox.ac.uk/news/2024-04-10-world-first-cybercrime-...
      • ziddoap 2y ago
        How/why did you pick these 7? Using your link: Ukraine, USA, UK, Brazil, & India all rank higher than Iran and Belarus. US & Ukraine rank higher than Nigeria and Romania.
        • kasey_junk 2y ago
          Those countries likely have a higher chance of real traffic as well. If I’m doing business in Nigeria then obviously I can’t block it even if it ranks high on the threat level.
• zelon88 2y ago
  The problems I noticed were, it doesn't matter what the SPF and DKIM look like. If Google or Microsoft refuse to relay your email based on secret internal factors then you're out of business.
  • freedomben 2y ago
    Yes, and they do that routinely.
    • ZeroTalent 2y ago
      Same with AWS SES, in my experience.
  • graemep 2y ago
    Microsoft seems to be the most common culprit.
    • scarab92 2y ago
      Agree. I don’t understand why Microsoft are so bad at this? They have access to a large percentage of all email traffic to train domain reputation, and spam detection models on yet seem to be notorious for both false positives and false negatives. Google’s spam filters are far more accurate.
      • graemep 2y ago
        I think they cannot be bothered. Their customers are more tied in than Google's and are not going to switch because a small proportion of emails are rejected. More specifically they seem to rely IP reputation rather than domain reputation, and IPs do change hands, especially for smaller servers.
  • miohtama 2y ago
    Best, and often practically only, way to avoid this problem is to buy your email services from Google Microsoft duopoly.
• wruza 2y ago
  As a non-email guy, I can tell you that if a system that boils down to having an (optionally certified?) key requires much more than just putting it into a folder with a domain name and running a service, it’s badly designed and has unnecessary complexity. Which will result into abusers having more expertise than legitimate users. The fact that you can “get” DMARC SPF DKIM wrong, while it’s basically a hard requirement for operation, is just screaming something important to the email software.
  • trod1234 2y ago
    As a generalist admin, would you say the same about DBA operations or would you say that's just not my specialty? The reasoning you provide doesn't differentiate, and speaks more of frustration which naturally comes with any area you aren't steeped in, or knowledgeable about.
    • wruza 2y ago
      Frustration doesn't come naturally. It comes with shitty software design. "I don't know" is not a problem, you learn and you know, no frustration. The problem is "I spent N hours/days on a thing that everyone does and which is a 99.99% of use cases and boils down to just having a keyfile in a proper(?) location and this knowledge doesn't translate effing nowhere". would you say the same about DBA operations or would you say that's just not my specialty It depends on the absurdity of the complexity of setting something up, not on operations themselves. Getting some results is absurdly complex -- not naturally complex and not necessarily very complex, just much more complex than the nature of the result itself. For example, that's how you were supposed to install openvpn before angristan scripts: https://www.digitalocean.com/community/tutorials/how-to-set-up-and-configure-an-openvpn-server-on-ubuntu-20-04 https://www.digitalocean.com/community/tutorials/how-to-set-... . To save someone a click, it's 50 pages "installation tutorial" with around 50 commands and a dozen of config files. And guess what, it uses "easyrsa" package to "set up RSA PKI easily". So it's not how openvpn meant to be installed, but an "easy" way.
      • trod1234 2y ago
• Justsignedup 2y ago
  As someone who set these up, I can tell you, the answer is rather simple: - spammers have 1 system to set up in order to spam. They get it right. - company admins have dozens of projects, of which this is a tiny one, with zero ROI to the bottom line (if people don't consider how critical security is). So they delay. - companies often have dozens of systems integrated, when I set up DMARC/DKIM the first time for my company, a bunch of email tools broke, we had to do a bunch of leg work, took us a month end-to-end. The value was recognized when we almost lost 20k to a "ceo emails you" scam. But until then it wasn't a priority. - we didn't even have a full IT, i just stepped in because I cared enough. - my current company has a dedicated security team. These holes are plugged VERY quickly.