←back to thread

Spammers are better at SPF, DKIM, and DMARC than everyone else

(toad.social)
429 points pabs3 | 2 comments | 25 Mar 25 08:14 UTC | HN request time: 0.431s | source
Show context
riobard ◴[25 Mar 25 11:17 UTC] No.43469919[source]▶
The point of SPF/DKIM/DMARC is to bind emails to domains, so no more spoofing. It is naive to expect authentication alone can reduce spams.
replies(4): >>43469940 #>>43470124 #>>43470532 #>>43470789 #
dizhn ◴[25 Mar 25 13:13 UTC] No.43470789[source]▶
All of these technologies are basically DOA because of how fickle they are and for lack of support across the board. Most policies are set to not to deny.

DMARC is nice though. It won't stop spam. It won't stop spoofing. But you will know that someone somewhere is spamming people using your domain name. How awesome. :)

replies(1): >>43471929 #
toast0 ◴[25 Mar 25 14:41 UTC] No.43471929[source]▶
I never found the DMARC reports actionable, so I quickly turned them off. What do you do with the information?

Of course, even with hard fail spf and dmarc, I still see some bounces from spam where some server accepted the mail to deliver it elsewhere and the next server denies it, so the first server sends me a bounce.

replies(1): >>43473794 #
1. riobard ◴[25 Mar 25 17:32 UTC] No.43473794[source]▶
DMARC reports are for you to be sure that you configured SPF/DKIM correctly, not asking you to do something with the spoofing senders (which you can do absolutely nothing about).
replies(1): >>43474744 #
2. toast0 ◴[25 Mar 25 19:14 UTC] No.43474744[source]▶
Yeah, so have reports when you start, but once you get things set up correctly, turn off the reports. If you break things later, you should find out quickly when mail is refused, and you can turn on reports again, if you need to.