Conversation

Notices

1. Embed this notice
   jwz (jwz@mastodon.social)'s status on Monday, 24-Mar-2025 05:55:52 JST jwz

   Taking a stroll through my spam folder, I saw a bunch of legitimate messages from people and companies with their own domains, that are not publishing DMARC and SPF records. Surely everyone (and by everyone I mean Google) is rejecting their mail? How do they not realize this?

   Then I noticed that one of them was received *from* gmail, so their mail probably works fine so long as they only mail gmail users. But another was via Yahoo, so that doesn't track.
   https://jwz.org/b/ykk8

   • Haelwenn /элвэн/ :triskell: likes this.
   • Embed this notice
     mx alex tax1a - 2020 (5) (atax1a@infosec.exchange)'s status on Monday, 24-Mar-2025 06:03:06 JST mx alex tax1a - 2020 (5)

     in reply to

     • 🆘Bill Cole 🇺🇦

     @jwz @grumpybozo just one more public key in a TXT record, that'll fix email, just gotta add one more TXT record bro

     Haelwenn /элвэн/ :triskell: and Fish of Rage like this.
   • Embed this notice
     jwz (jwz@mastodon.social)'s status on Monday, 24-Mar-2025 06:03:07 JST jwz

     in reply to

     • 🆘Bill Cole 🇺🇦

     @grumpybozo Wow, that's amazing. Great job everybody! So glad we spent so much time implementing all of that crap!

   • Embed this notice
     🆘Bill Cole 🇺🇦 (grumpybozo@toad.social)'s status on Monday, 24-Mar-2025 06:03:08 JST 🆘Bill Cole 🇺🇦

     in reply to

     @jwz The stats we collect for the #SpamAssassin project (mass-scan results from participating sites) have long shown that spammers are more consistent at making SPF, DKIM, and DMARC correct than are legitimate senders. DMARC in particular has no discernible benefit for most senders, so it is a useless signal.

     Rejecting mail based solely on authentication failures of those deeply flawed authentication methods does more harm than good.

     Haelwenn /элвэн/ :triskell: likes this.
   • Embed this notice
     mx alex tax1a - 2020 (5) (atax1a@infosec.exchange)'s status on Wednesday, 26-Mar-2025 01:16:35 JST mx alex tax1a - 2020 (5)

     in reply to

     • 🆘Bill Cole 🇺🇦

     @grumpybozo @jwz and don't get us started on how dnssec is untroubleshootable garbage whose main failure mode is to turn your entire domain into an unresolvable sinkhole

   • Embed this notice
     🆘Bill Cole 🇺🇦 (grumpybozo@toad.social)'s status on Wednesday, 26-Mar-2025 01:16:36 JST 🆘Bill Cole 🇺🇦

     in reply to

     • mx alex tax1a - 2020 (5)

     @atax1a @jwz It is a frustration that for DKIM, DMARC, and SPF to be as trustworthy as possible, one must deploy DNSSEC correctly and defend one's domain against any threat to its reputation but all the spammers need to do is buy a cheap domain with any old garbage DNS and get a handful of records right.

     feld repeated this.