4 ms·

Aw hell. How many things do I have to set up just so that I can send e-mails from my own domain? The effect of all this seems to be less "making e-mail secure"

by qurren 3mo ago

Aw hell. How many things do I have to set up just so that I can send e-mails from my own domain? The effect of all this seems to be less "making e-mail secure" and more "making it so that only Google, Apple, and Microsoft can send e-mail successfully"

doubled112 3mo ago
And sometimes if you do everything right, it still doesn’t work. Recently I checked the IP against blacklists, waited a few months, did all of the other things, and then found out Microsoft bounces my entire VPS’s IP range. Appealing did not help. They intermittently block Cloudflare email routing IPs too. All of these security measures and still it comes down to the IP address of your sender.
- 1over137 3mo ago
  Is it an el cheapo VPS?
  - doubled112 3mo ago
    Is Cloudflare a cheapo VPS? It is a cheap VPS, but it would still be nice if there was a way to know (not assume) beforehand. > 550 5.7.1 Unfortunately, messages from [IP ADDRESS] weren't sent. Please contact your Internet service provider since part of their network is on our block list (S3150). > Your IP(s) qualify for conditional mitigation. Still blocked. The system is working as expected.
    - jeffbee 3mo ago
      I would simply like to point out that 550 at SMTP time is not a bounce.
      - doubled112 3mo ago
        You get an email bounce back with an error code in it. Is there some other definition I'm unaware of? Wait, that is probably from the local mailer, and otherwise the sender may never know about the rejected messages.
      - b112 3mo ago
        5xx are bounces, a perm failure. 4xx error codes are temp (retry) errors.
        jeffbee 3mo ago
        Incorrect. A bounce is a delivery status notification generated by a mailer after it has already accepted a message for delivery. A 5xx permanent error is a refusal to accept the message in the first place.
        TZubiri 3mo ago
        Is this standarized terminology in some RFC like SMTP? Or is it presumably some well established folk lingo?
        b112 3mo ago
        They're referring to the bounced notification message, not the fact that the mail bounced. Verb and noun. A 5xx is a bounce, and results in a bounced email message. Variances always abound, but I'll stick with my 30 year old terminology, and it is correct.
        jeffbee 3mo ago
        That's fair with regards to your statement, but "doubled112" assigned the agency to Microsoft, saying that "Microsoft bounces" their traffic, which is demonstrably not what is happening.
        b112 3mo ago
        It is what's happening, as I've described. A 5xx is a bounce. You don't agree with my terminology, but we're not disagreeing on what's happening. In this case, as per my dictionary, 'rejected' and 'bounced' are synonyms. If this was me, and my MTA hitting this Microsoft server, my MTA/server would see the bounce(5xx), then my MTA/server would generate a bounce message(email) which I'd receive in my inbox. The bounce message is a result of the bounce. The action/cause is the bounce/reject 5xx. How can you have a bounce message, without a bounce happening? Again, you don't agree with this terminology, and that's fine. But I'm not pulling this out of a random hat, it's 30+ year old terminology that I've used with endless people locally and online. That doesn't mean your view is wrong, we may just be running into local variances in lingo. There are all sorts of edge cases in our compute discourse. I ran into a company where they didn't use initialisms to discuss daemons/protocols, but treated them as acronyms. Of course, they didn't really discuss such things often. So when discussing smtp, they'd pronounce it 'sim-tee'. Of course, sntpd, smtpd, snmpd, and others are all pronunced 'sim-tee', which makes for a fun meeting. Think of it as 'I am groot' taken too far. For prudence, I kept enforcing initialisms, which of course resolved this. Anyhow! Point is, well.. not really sure except info.
    - inigyou 3mo ago
      Cloudflare is one of the shadiest hosts around, almost as bad as the big three clouds.
    - TZubiri 3mo ago
      You can't have the cake and eat it too. Either you use cheap infrastructure that attackers can buy by the bulk for sybil attacks. Or you pay a reasonable price for a slice of an IP block that doesn't share its reputation with elcheapos.
      - doubled112 3mo ago
        No disagreement here. I had never planned to use it for email, but I was bored and I already had it when I got an idea.
braiamp 3mo ago
Eh, I read the article, and at most you only have to wait for your MTA to update to add the required headers and update your DNS records and you are golden. It still uses the same key you generated as far I'm aware.
brightball 3mo ago
DMARC isn't for sending email successfully, it's for preventing other people from impersonating your domain. Without it, there's nothing stopping anybody from sending an email saying it is from you@qurren.com. SPF tried. DKIM tried. Both of them had gaps. When you use them together and have a DMARC policy that requires one of them or the other for successful delivery, it's the best current solution.
- qurren 3mo ago
  Except I think I've had 1:1 personal e-mails from my domain go into a legitimate recipient's spam filter just because I didn't have DMARC set up and their mail server was flagging that "DMARC not set up == spammy domain"
  - drdexebtjl 3mo ago
    That is perfectly reasonable. Set it up correctly.
    - bombcar 3mo ago
      It is so much easier to set these things up with a frontier AI to walk you through the Byzantine steps.
      - denkmoon 3mo ago
        It takes an afternoon to set up DKIM and DMARC from scratch on a debian VPS. Yeah it's a little bit byzantine but it's not rocket science.
        qurren 3mo ago
        Yeah I did that. Now it seems I have to set up DKIM2 and DMARC2 and DCRAP3 and DSHIT4 for another afternoon instead of just going to work and getting shit done.
        3mo ago
OneDeuxTriSeiGo 3mo ago
DKIM2 and DMARCbis are actually the opposite of this. They are long awaited fixes of brittle and often broken systems that are designed to now make providing secure email easier rather than harder. They both have fairly clean migration paths and resolve a lot of the annoying edge cases that currently exist with authenticating and verifying email.
- binkHN 3mo ago
  Thanks for this, it made me actually read the posted content, but there's a lot of content to digest and a lot MTAs will have to implement.
AceJohnny2 3mo ago
> Aw hell. How many things do I have to set up just so that I can send e-mails from my own domain? ... said every spammer. I'm sorry for your pain, and I'm in the same boat. But it's important to understand that any sufficiently large, distributed-agent system (like federated email), will see the rise of parasites that will pump resources and diminish the value of the system. What we're seeing here is an "immune" response to those parasites. We all pay for it. I think this is an important lesson for anyone designing a distributed-agent system [1]. How do you design it so as to keep the bad actors out, or at least so their impact is negligeable? [1] imma make my own email system! With blackjack, and hookers! oh wait...
- assimpleaspossi 3mo ago
  >>parasites that will pump resources and diminish the value of the system. Countries' legal systems really need to do something about them.
  - zbentley 3mo ago
    I don’t think they can. Spam, like speeding on highways and drug sales, is such an asymmetric enforcement area that I have very limited confidence that legal enforcement would make a significant dent in the volume. It’s far too technically easy to anonymously, repeatedly break anti-spam laws. This is an area where consortium enforcement (like the big inbox providers pushing solutions like DKIM2) is probably the most effective. Don’t get me wrong, there are tons of areas where countries’ legal systems have no excuse for not enforcing the law more stringently (e.g. flagrant corruption in multiple regulatory bodies’ failure to enforce investment/wire fraud). But spam is part of the other category—technically difficult enough to crack down on that legal action is a waste of time. There are ways to change that, but they’re all either more centralization-prone, worse for privacy/liberty, or extremely expensive.
    - inigyou 3mo ago
      They keep finding that huge spam campaigns were run by one guy from his bedroom. I can't remember which specific spam campaign was recently caught, it might've been the phone spam about car insurance. It was one guy with a huge botnet. In total they are a finite set, and even catching 5% of them will scare the rest.
hinkley 3mo ago
This sort of Regulatory Capture is quite old in the software field. People were already noticing it in the 90's. Making a spec that contains a venn diagram of most of the features each of the signatories to the specification have implemented themselves ends up pulling the ladder up behind them. Each non-academic committee member discovers they're already more than 75% of the way to having completed the spec and any junior members or amateurs have years of work to do in order to catch up to Now. If any upstarts threaten to get within striking distance of an implementation you can always convene the committee again and discuss version 2 of the spec. Mobile devices tamped this down just a little bit but mostly they lowered the slope of the line a hair and changed where the focus was a bit.

by qurren 3mo ago

doubled112 3mo ago

And sometimes if you do everything right, it still doesn’t work. Recently I checked the IP against blacklists, waited a few months, did all of the other things, and then found out Microsoft bounces my entire VPS’s IP range. Appealing did not help. They intermittently block Cloudflare email routing IPs too. All of these security measures and still it comes down to the IP address of your sender.

1over137 3mo ago
Is it an el cheapo VPS?
- doubled112 3mo ago
  Is Cloudflare a cheapo VPS? It is a cheap VPS, but it would still be nice if there was a way to know (not assume) beforehand. > 550 5.7.1 Unfortunately, messages from [IP ADDRESS] weren't sent. Please contact your Internet service provider since part of their network is on our block list (S3150). > Your IP(s) qualify for conditional mitigation. Still blocked. The system is working as expected.
  - jeffbee 3mo ago
    I would simply like to point out that 550 at SMTP time is not a bounce.
    - doubled112 3mo ago
      You get an email bounce back with an error code in it. Is there some other definition I'm unaware of? Wait, that is probably from the local mailer, and otherwise the sender may never know about the rejected messages.
    - b112 3mo ago
      5xx are bounces, a perm failure. 4xx error codes are temp (retry) errors.
      - jeffbee 3mo ago
        Incorrect. A bounce is a delivery status notification generated by a mailer after it has already accepted a message for delivery. A 5xx permanent error is a refusal to accept the message in the first place.
        TZubiri 3mo ago
        Is this standarized terminology in some RFC like SMTP? Or is it presumably some well established folk lingo?
        b112 3mo ago
        They're referring to the bounced notification message, not the fact that the mail bounced. Verb and noun. A 5xx is a bounce, and results in a bounced email message. Variances always abound, but I'll stick with my 30 year old terminology, and it is correct.
        jeffbee 3mo ago
        That's fair with regards to your statement, but "doubled112" assigned the agency to Microsoft, saying that "Microsoft bounces" their traffic, which is demonstrably not what is happening.
        b112 3mo ago
        It is what's happening, as I've described. A 5xx is a bounce. You don't agree with my terminology, but we're not disagreeing on what's happening. In this case, as per my dictionary, 'rejected' and 'bounced' are synonyms. If this was me, and my MTA hitting this Microsoft server, my MTA/server would see the bounce(5xx), then my MTA/server would generate a bounce message(email) which I'd receive in my inbox. The bounce message is a result of the bounce. The action/cause is the bounce/reject 5xx. How can you have a bounce message, without a bounce happening? Again, you don't agree with this terminology, and that's fine. But I'm not pulling this out of a random hat, it's 30+ year old terminology that I've used with endless people locally and online. That doesn't mean your view is wrong, we may just be running into local variances in lingo. There are all sorts of edge cases in our compute discourse. I ran into a company where they didn't use initialisms to discuss daemons/protocols, but treated them as acronyms. Of course, they didn't really discuss such things often. So when discussing smtp, they'd pronounce it 'sim-tee'. Of course, sntpd, smtpd, snmpd, and others are all pronunced 'sim-tee', which makes for a fun meeting. Think of it as 'I am groot' taken too far. For prudence, I kept enforcing initialisms, which of course resolved this. Anyhow! Point is, well.. not really sure except info.
  - inigyou 3mo ago
    Cloudflare is one of the shadiest hosts around, almost as bad as the big three clouds.
  - TZubiri 3mo ago
    You can't have the cake and eat it too. Either you use cheap infrastructure that attackers can buy by the bulk for sybil attacks. Or you pay a reasonable price for a slice of an IP block that doesn't share its reputation with elcheapos.
    - doubled112 3mo ago
      No disagreement here. I had never planned to use it for email, but I was bored and I already had it when I got an idea.

braiamp 3mo ago

Eh, I read the article, and at most you only have to wait for your MTA to update to add the required headers and update your DNS records and you are golden. It still uses the same key you generated as far I'm aware.

brightball 3mo ago

DMARC isn't for sending email successfully, it's for preventing other people from impersonating your domain. Without it, there's nothing stopping anybody from sending an email saying it is from you@qurren.com. SPF tried. DKIM tried. Both of them had gaps. When you use them together and have a DMARC policy that requires one of them or the other for successful delivery, it's the best current solution.

qurren 3mo ago
Except I think I've had 1:1 personal e-mails from my domain go into a legitimate recipient's spam filter just because I didn't have DMARC set up and their mail server was flagging that "DMARC not set up == spammy domain"
- drdexebtjl 3mo ago
  That is perfectly reasonable. Set it up correctly.
  - bombcar 3mo ago
    It is so much easier to set these things up with a frontier AI to walk you through the Byzantine steps.
    - denkmoon 3mo ago
      It takes an afternoon to set up DKIM and DMARC from scratch on a debian VPS. Yeah it's a little bit byzantine but it's not rocket science.
      - qurren 3mo ago
        Yeah I did that. Now it seems I have to set up DKIM2 and DMARC2 and DCRAP3 and DSHIT4 for another afternoon instead of just going to work and getting shit done.
        3mo ago

OneDeuxTriSeiGo 3mo ago

DKIM2 and DMARCbis are actually the opposite of this. They are long awaited fixes of brittle and often broken systems that are designed to now make providing secure email easier rather than harder. They both have fairly clean migration paths and resolve a lot of the annoying edge cases that currently exist with authenticating and verifying email.

binkHN 3mo ago
Thanks for this, it made me actually read the posted content, but there's a lot of content to digest and a lot MTAs will have to implement.

AceJohnny2 3mo ago

> Aw hell. How many things do I have to set up just so that I can send e-mails from my own domain? ... said every spammer. I'm sorry for your pain, and I'm in the same boat. But it's important to understand that any sufficiently large, distributed-agent system (like federated email), will see the rise of parasites that will pump resources and diminish the value of the system. What we're seeing here is an "immune" response to those parasites. We all pay for it. I think this is an important lesson for anyone designing a distributed-agent system [1]. How do you design it so as to keep the bad actors out, or at least so their impact is negligeable? [1] imma make my own email system! With blackjack, and hookers! oh wait...

assimpleaspossi 3mo ago
>>parasites that will pump resources and diminish the value of the system. Countries' legal systems really need to do something about them.
- zbentley 3mo ago
  I don’t think they can. Spam, like speeding on highways and drug sales, is such an asymmetric enforcement area that I have very limited confidence that legal enforcement would make a significant dent in the volume. It’s far too technically easy to anonymously, repeatedly break anti-spam laws. This is an area where consortium enforcement (like the big inbox providers pushing solutions like DKIM2) is probably the most effective. Don’t get me wrong, there are tons of areas where countries’ legal systems have no excuse for not enforcing the law more stringently (e.g. flagrant corruption in multiple regulatory bodies’ failure to enforce investment/wire fraud). But spam is part of the other category—technically difficult enough to crack down on that legal action is a waste of time. There are ways to change that, but they’re all either more centralization-prone, worse for privacy/liberty, or extremely expensive.
  - inigyou 3mo ago
    They keep finding that huge spam campaigns were run by one guy from his bedroom. I can't remember which specific spam campaign was recently caught, it might've been the phone spam about car insurance. It was one guy with a huge botnet. In total they are a finite set, and even catching 5% of them will scare the rest.

hinkley 3mo ago

This sort of Regulatory Capture is quite old in the software field. People were already noticing it in the 90's. Making a spec that contains a venn diagram of most of the features each of the signatories to the specification have implemented themselves ends up pulling the ladder up behind them. Each non-academic committee member discovers they're already more than 75% of the way to having completed the spec and any junior members or amateurs have years of work to do in order to catch up to Now. If any upstarts threaten to get within striking distance of an implementation you can always convene the committee again and discuss version 2 of the spec. Mobile devices tamped this down just a little bit but mostly they lowered the slope of the line a hair and changed where the focus was a bit.