Conversation

Notices

1. Embed this notice
   hanno (hanno@mastodon.social)'s status on Monday, 25-Nov-2024 17:56:28 JST hanno

   Dear everyone who owns domains that are *not used for e-mail*, particularly ones that are potential targets for phishing (banks, high-profile names): Could you please configure SPF+DMARC, ideally with p=reject? You may wonder: Why should I configure anything email for a host that isn't used for email? Well... it helps others to identify spam sent with your domain as the sender.

   • Embed this notice
     Max Mehl (mxmehl@mastodon.social)'s status on Tuesday, 26-Nov-2024 14:35:17 JST Max Mehl

     in reply to

     • uberspace.de
     • Tim Philipp Schäfers

     @hanno @TimPhSchaefers @ubernauten I don't understand what Uberspace would need to fix. You can do all these things only via DNS, and that's in your sole control.

   • Embed this notice
     hanno (hanno@mastodon.social)'s status on Tuesday, 26-Nov-2024 14:35:18 JST hanno

     in reply to

     • uberspace.de
     • Tim Philipp Schäfers

     @TimPhSchaefers then @ubernauten should fix that. Allow customers to set a "no email" option that sets dmarc to reject, SPF to -all, and mx to . (nullmx)

   • Embed this notice
     Tim Philipp Schäfers (timphschaefers@chaos.social)'s status on Tuesday, 26-Nov-2024 14:35:28 JST Tim Philipp Schäfers

     in reply to

     @hanno I guess the problem in most of the times is - that hosting providers (for example Uberspace) provide you with SPF/DMARC only if you configure a mailserver on the webspace ... I guess many other hosters do this aswell ...

   • Embed this notice
     hanno (hanno@mastodon.social)'s status on Tuesday, 26-Nov-2024 14:35:29 JST hanno

     in reply to

     I'm seeing lots of spam lately either from domains that have [easytoremembername].com and end up being domains for sale, or, today, a flood of [name of bank].de, which belongs to the bank, but is probably not used by them for email. All without DMARC.
     I don't recommend p=reject for actually used domains, but for domains that are *unused for email*, you have no deliverability problem, you want non-deliverability for all mails with that sender.