7 ms·

Sadly the article doesn't really touch on whether or not DMARC accomplishes anything truly useful. When I enabled DMARC for ingress email on one of my own mail

by bcrl 2mo ago

Sadly the article doesn't really touch on whether or not DMARC accomplishes anything truly useful. When I enabled DMARC for ingress email on one of my own mail servers, it ultimately ended up regularly blocking a handful emails from customers, yet virtually all the spam coming in had valid SPF / DKIM / DMARC, as do most of the phishing attacks. The core problem is that the real need of email end users need is a way of determining whether or not to trust a given sender. Signatures are purely a technical measure which provides no information on the trustworthiness of the sender. The end result is that email scoring still has to be content based, and the signature check technologies are pure noise with no useful signal for the purpose of determining if an email should actually show up in my inbox. The tech industry has a bad habit of providing solutions to problems adjacent to problems the user actually needs solved while leaving the user's actual problem unresolved.

bawolff 2mo ago
> The core problem is that the real need of email end users need is a way of determining whether or not to trust a given sender. Which is only the core problem because dmarc fixed the other core problem of figuring out who the given sender is. DMARC does not solve everything, but it does make other solutions more effective.
- deknos 2mo ago
  > Which is only the core problem because dmarc fixed the other core problem of figuring out who the given sender is. Does it verify the sender or the domain/service which the sender is using?
  - inigyou 2mo ago
    Yes. If an email comes from alice@gmail and validates to gmail, alice sent it. It's possible that gmail screwed up and gave Bob access to Alice's account. In this situation, though, Alice still sent it.
    - Freebytes 2mo ago
      Google is not the only email provider in the world, though. Not all email services are global corporations, and we must be careful never to interrupt the services of independent email providers.
      - inigyou 2mo ago
        If it comes from alice@foobar and validates to foobar, Alice sent it
cookiengineer 2mo ago
^ this Additionally, I would probably guess correctly that almost all spam comes from rotating ASNs these days. Aka from companies that do "growth marketing" or other bullshit that isn't a valid business but just... spamming people. A lot of the domains that fall through the cracks for single-spam-campaigns have been taken over by botnet campaigns, so the actual owners of said domains probably don't know that their website is spamming everyone else. But the major providers are the culprit, too, here. Gmail, hotmail, microsoft o365, mailgun ... they all don't even enforce SSL from server to server, and let through "sendmail" like spam because the spammers are paying customers to them. Source: I am maintaining antispam [1] which I am using to combat spam, phishing, and malware campaigns targeting my customer networks. [1] https://github.com/cookiengineer/antispam https://github.com/cookiengineer/antispam
- Geezus_42 2mo ago
  Why would you care about TLS for spam? Are you proposing that any email sent without TLS should be label spam?
  - cookiengineer 2mo ago
    The cheaper the relay mechanism is, the more noise/spam you'll get. Lots of servers online have a publicly exposed smtp port, where all kinds of script kiddies are just using a sendmail style email from another (not-owned) domain. DKIM/DMARC tried to fix this (without success due to fakeable entries in the DNS records, spf=all is pretty much everywhere anyways nowadays). So my proposal for actual ownership of domain AND server infrastructure would be mutual TLS. Reverse IP lookups are broken almost always anyways, due to most hosting providers not offering real reverse DNS infrastructure that users can modify. This way a compromised server can't send as another domain, and large-scale spamming relays that rotate ASNs would have indicators in the cert itself, which they run out of real quick due to limitations of how many IP/DNS subjects you can set in an SSL/TLS cert. No faking and avoiding bad IP reputations by rotating ASNs anymore.
    - Geezus_42 2mo ago
newsoftheday 2mo ago
My domain is very low traffic but, I just looked through my admin email account and opendmarc has rejected 18 attempts by spammers just this past week. More were rejected by my domain's DMARC policy.
- bcrl 2mo ago
  It works at small scale when you self-select for technical competency. It does not work at larger scale when that self selection is no longer possible. My scale is that I ran an ISP for ~500 users before the network was disassembled last month. At that scale, you will encounter people that make mistakes with their email setups. When the people who make mistakes are customers which DMARC prevents delivery of emails, it is an issue as those are exactly the people for which I want to see the emails from. I get more spam with valid SPF and DKIM via Google's own mail servers than DMARC blocks. It says something when even gmail doesn't use DMARC as a signal that an email is valid, as gmail regularly blocks legitimate mailing list emails with completely valid signatures and non-spam content from a reputationaly sound IP. The problem DMARC was supposed to solve (impersonation to reduce spam) isn't solved by DMARC.
SoftTalker 2mo ago
My work email is Outlook, which is horribly broken and terrible to use. I have a rule configured to "re-send" all my mail to a different account where I read it with a usable MUA. Unfortunately this seems to break DMARC for external mail as now an email from e.g. user@example.com appears to have been sent by outlook.com.
- matharmin 2mo ago
  I'm not familiar with Outlook's resending, but the use case is supported if the sender uses DKIM. If the email is forwarded without changing any details, it can keep the DKIM signature. That allows the forwarded email to still pass DMARC. Now if the sender used SPF + DMARC but not DKIM, this does not work, since the sender IP can't be verified with the forwarded email. In that case, the forwarder has to change the from address to prevent the email from failing DMARC and be rejected. In practice, senders using SPF+DMARC but not DKIM should be quite rare, you see DKIM+DMARC much more often.
  - Polizeiposaune 2mo ago
    I have a long-standing email address that forwards to an email system that I run. The operator of the forwarder switched to using Microsoft's mail infrastructure some years ago and the quality of service of the forward has degraded dramatically ever since. I've often seen messages resent by Microsoft's mail infrastructure with gratuitously broken DKIM signatures, generally due to changes to whitespace that are not anticipated by DKIM's message canonicalization. I've also seen messages sent by my bank directly to the email system I administer that had broken DKIM signatures apparently due to some sort of antivirus software they had downstream of the DKIM signer.
    - ryanbrunner 2mo ago
      Outlook.com also seems to routinely ignore DMARC (it will bounce emails with a DMARC that's report only)
    - matharmin 2mo ago
brightball 2mo ago
> virtually all the spam coming in had valid SPF / DKIM / DMARC, as do most of the phishing attacks. This should create a means to go after the domain owners via registrar and trail of ownership, even so far as blocking email from the domain. Forcing the spammers to pass DMARC creates a burden and an evidence trail that didn't exist before.
- bigbuppo 2mo ago
  They're generally hosted on a google or microsoft 365 or something slightly less shady. Good luck with that.
- WorldMaker 2mo ago
  Can we use DMARC to ask Gmail to close registrations? Google Calendar to allow far fewer people the ability to send invite notifications? Firebase to close registrations? Azure? Microsoft 365? AWS SES? It feels like the biggest spammers have swung back to just abusing SaaS and getting SPF / DKIM / DMARC for free from one of the big email providers.
  - bcrl 2mo ago
    Exactly this. Spammers have the technical competence to overcome any technical hurdle, so using evidence of technical competence achieves nothing. If it were possible to charge $0.25/email for delivery, I'd be more than happy . However, I'm sure large tech firms will need to say that is "too hard to implement at scale".
    - WorldMaker 2mo ago
      Stamp costs don't stop snail mail spam, either, unfortunately. I would be concerned if we added something like bitcoin fees to email delivery rather than curtail spam it would just further encourage grifters seeking ROI on their spam deliveries.
      - ebcode 2mo ago
        What if a single email cost $0.001 cent to send, and it was paid to the recipient? For $10, you could send 10,000 emails. For recipients, every 1,000 emails they get is a dollar in their wallet. You’d need something like a blockchain for this to work because the traditional payment processors still haven’t figured out micropayments.
thedougd 2mo ago
The primary purpose of DMARC is to prevent impersonation not to prevent spam. I own a domain, I implement DMARC to make sure others know when email from my domain is legitimately from my domain.
- HenriTEL 2mo ago
  Isn't that the purpose of DKIM and SPF already?
  - wafflebot 2mo ago
    DKIM and SPF validate a message. DMARC sets a policy as to what to do with it (quarantine/reject.)
    - inigyou 2mo ago
      So DMARC is just advertising whether you think your SPF and DKIM are set up correctly? Seems useless to me. SPF already specifies what to do with messages that fail SPF. SPF is necessary. DKIM is questionable. DMARC is useless.
  - warkdarrior 2mo ago
    ELI5: https://www.reddit.com/r/sysadmin/comments/16gvtdj/comment/k0aidyz/ https://www.reddit.com/r/sysadmin/comments/16gvtdj/comment/k...
    - joemi 2mo ago
      Wish I didn't have to log in to reddit to read that post. RIP useful reddit links. edit: looks like I had an extension that was redirecting to old.reddit.com, and it was old reddit that required login. Though when I turned that extension off, I got a "blocked by reddit security" error. ugggh.
      - justsomehnguy 2mo ago
        [–]iceph03nix 655 points 2 years ago SPF: These are the servers I will send from. If it says it's from me, but comes from somewhere else, it's likely fake DKIM: This is my signature, if it's not on the email, it probably didn't come from my server. DMARC: If you get mail that doesn't match the above, here's what I want you to do with it.
egorfine 2mo ago
> The tech industry has a bad habit of providing solutions to problems adjacent to problems the user actually needs solved while leaving the user's actual problem unresolved. Extremely well said.
deleted 2mo ago
[deleted]
Geezus_42 2mo ago
Stopping spam isn't what DMARC was designed for.
bks 2mo ago
[flagged]

by bcrl 2mo ago

bawolff 2mo ago

> The core problem is that the real need of email end users need is a way of determining whether or not to trust a given sender. Which is only the core problem because dmarc fixed the other core problem of figuring out who the given sender is. DMARC does not solve everything, but it does make other solutions more effective.

deknos 2mo ago
> Which is only the core problem because dmarc fixed the other core problem of figuring out who the given sender is. Does it verify the sender or the domain/service which the sender is using?
- inigyou 2mo ago
  Yes. If an email comes from alice@gmail and validates to gmail, alice sent it. It's possible that gmail screwed up and gave Bob access to Alice's account. In this situation, though, Alice still sent it.
  - Freebytes 2mo ago
    Google is not the only email provider in the world, though. Not all email services are global corporations, and we must be careful never to interrupt the services of independent email providers.
    - inigyou 2mo ago
      If it comes from alice@foobar and validates to foobar, Alice sent it

cookiengineer 2mo ago

^ this Additionally, I would probably guess correctly that almost all spam comes from rotating ASNs these days. Aka from companies that do "growth marketing" or other bullshit that isn't a valid business but just... spamming people. A lot of the domains that fall through the cracks for single-spam-campaigns have been taken over by botnet campaigns, so the actual owners of said domains probably don't know that their website is spamming everyone else. But the major providers are the culprit, too, here. Gmail, hotmail, microsoft o365, mailgun ... they all don't even enforce SSL from server to server, and let through "sendmail" like spam because the spammers are paying customers to them. Source: I am maintaining antispam [1] which I am using to combat spam, phishing, and malware campaigns targeting my customer networks. [1] https://github.com/cookiengineer/antispam https://github.com/cookiengineer/antispam

Geezus_42 2mo ago
Why would you care about TLS for spam? Are you proposing that any email sent without TLS should be label spam?
- cookiengineer 2mo ago
  The cheaper the relay mechanism is, the more noise/spam you'll get. Lots of servers online have a publicly exposed smtp port, where all kinds of script kiddies are just using a sendmail style email from another (not-owned) domain. DKIM/DMARC tried to fix this (without success due to fakeable entries in the DNS records, spf=all is pretty much everywhere anyways nowadays). So my proposal for actual ownership of domain AND server infrastructure would be mutual TLS. Reverse IP lookups are broken almost always anyways, due to most hosting providers not offering real reverse DNS infrastructure that users can modify. This way a compromised server can't send as another domain, and large-scale spamming relays that rotate ASNs would have indicators in the cert itself, which they run out of real quick due to limitations of how many IP/DNS subjects you can set in an SSL/TLS cert. No faking and avoiding bad IP reputations by rotating ASNs anymore.
  - Geezus_42 2mo ago

newsoftheday 2mo ago

My domain is very low traffic but, I just looked through my admin email account and opendmarc has rejected 18 attempts by spammers just this past week. More were rejected by my domain's DMARC policy.

bcrl 2mo ago
It works at small scale when you self-select for technical competency. It does not work at larger scale when that self selection is no longer possible. My scale is that I ran an ISP for ~500 users before the network was disassembled last month. At that scale, you will encounter people that make mistakes with their email setups. When the people who make mistakes are customers which DMARC prevents delivery of emails, it is an issue as those are exactly the people for which I want to see the emails from. I get more spam with valid SPF and DKIM via Google's own mail servers than DMARC blocks. It says something when even gmail doesn't use DMARC as a signal that an email is valid, as gmail regularly blocks legitimate mailing list emails with completely valid signatures and non-spam content from a reputationaly sound IP. The problem DMARC was supposed to solve (impersonation to reduce spam) isn't solved by DMARC.

SoftTalker 2mo ago

My work email is Outlook, which is horribly broken and terrible to use. I have a rule configured to "re-send" all my mail to a different account where I read it with a usable MUA. Unfortunately this seems to break DMARC for external mail as now an email from e.g. user@example.com appears to have been sent by outlook.com.

matharmin 2mo ago
I'm not familiar with Outlook's resending, but the use case is supported if the sender uses DKIM. If the email is forwarded without changing any details, it can keep the DKIM signature. That allows the forwarded email to still pass DMARC. Now if the sender used SPF + DMARC but not DKIM, this does not work, since the sender IP can't be verified with the forwarded email. In that case, the forwarder has to change the from address to prevent the email from failing DMARC and be rejected. In practice, senders using SPF+DMARC but not DKIM should be quite rare, you see DKIM+DMARC much more often.
- Polizeiposaune 2mo ago
  I have a long-standing email address that forwards to an email system that I run. The operator of the forwarder switched to using Microsoft's mail infrastructure some years ago and the quality of service of the forward has degraded dramatically ever since. I've often seen messages resent by Microsoft's mail infrastructure with gratuitously broken DKIM signatures, generally due to changes to whitespace that are not anticipated by DKIM's message canonicalization. I've also seen messages sent by my bank directly to the email system I administer that had broken DKIM signatures apparently due to some sort of antivirus software they had downstream of the DKIM signer.
  - ryanbrunner 2mo ago
    Outlook.com also seems to routinely ignore DMARC (it will bounce emails with a DMARC that's report only)
  - matharmin 2mo ago

brightball 2mo ago

> virtually all the spam coming in had valid SPF / DKIM / DMARC, as do most of the phishing attacks. This should create a means to go after the domain owners via registrar and trail of ownership, even so far as blocking email from the domain. Forcing the spammers to pass DMARC creates a burden and an evidence trail that didn't exist before.

bigbuppo 2mo ago
They're generally hosted on a google or microsoft 365 or something slightly less shady. Good luck with that.
WorldMaker 2mo ago
Can we use DMARC to ask Gmail to close registrations? Google Calendar to allow far fewer people the ability to send invite notifications? Firebase to close registrations? Azure? Microsoft 365? AWS SES? It feels like the biggest spammers have swung back to just abusing SaaS and getting SPF / DKIM / DMARC for free from one of the big email providers.
- bcrl 2mo ago
  Exactly this. Spammers have the technical competence to overcome any technical hurdle, so using evidence of technical competence achieves nothing. If it were possible to charge $0.25/email for delivery, I'd be more than happy . However, I'm sure large tech firms will need to say that is "too hard to implement at scale".
  - WorldMaker 2mo ago
    Stamp costs don't stop snail mail spam, either, unfortunately. I would be concerned if we added something like bitcoin fees to email delivery rather than curtail spam it would just further encourage grifters seeking ROI on their spam deliveries.
    - ebcode 2mo ago
      What if a single email cost $0.001 cent to send, and it was paid to the recipient? For $10, you could send 10,000 emails. For recipients, every 1,000 emails they get is a dollar in their wallet. You’d need something like a blockchain for this to work because the traditional payment processors still haven’t figured out micropayments.

thedougd 2mo ago

The primary purpose of DMARC is to prevent impersonation not to prevent spam. I own a domain, I implement DMARC to make sure others know when email from my domain is legitimately from my domain.

HenriTEL 2mo ago
Isn't that the purpose of DKIM and SPF already?
- wafflebot 2mo ago
  DKIM and SPF validate a message. DMARC sets a policy as to what to do with it (quarantine/reject.)
  - inigyou 2mo ago
    So DMARC is just advertising whether you think your SPF and DKIM are set up correctly? Seems useless to me. SPF already specifies what to do with messages that fail SPF. SPF is necessary. DKIM is questionable. DMARC is useless.
- warkdarrior 2mo ago
  ELI5: https://www.reddit.com/r/sysadmin/comments/16gvtdj/comment/k0aidyz/ https://www.reddit.com/r/sysadmin/comments/16gvtdj/comment/k...
  - joemi 2mo ago
    Wish I didn't have to log in to reddit to read that post. RIP useful reddit links. edit: looks like I had an extension that was redirecting to old.reddit.com, and it was old reddit that required login. Though when I turned that extension off, I got a "blocked by reddit security" error. ugggh.
    - justsomehnguy 2mo ago
      [–]iceph03nix 655 points 2 years ago SPF: These are the servers I will send from. If it says it's from me, but comes from somewhere else, it's likely fake DKIM: This is my signature, if it's not on the email, it probably didn't come from my server. DMARC: If you get mail that doesn't match the above, here's what I want you to do with it.

egorfine 2mo ago

> The tech industry has a bad habit of providing solutions to problems adjacent to problems the user actually needs solved while leaving the user's actual problem unresolved. Extremely well said.

deleted 2mo ago

[deleted]

Geezus_42 2mo ago

Stopping spam isn't what DMARC was designed for.

bks 2mo ago

[flagged]