Spammers are better at SPF, DKIM, and DMARC than everyone else

For me, as someone with their own mail server, these technologies mostly serve to inform me that Russian IP addresses are still trying to send email in the name of my domain for some stupid reason.

It makes sense that people whose business is sending email know how to set up email correctly. I'm mostly surprised at how many legitimate sysadmins struggle with getting the basics correct. Surely those dozens of DMARC emails you get that your sendgrid email has been refused because of a bad SPF signature should set in motion some kind of plan to ask if maybe marketing is using them legitimately?

Automated signatures are of limited value but I rarely see rejections based on SPF and DKIM that are a mistake. Things are probably worse for big organizations but as a small email server, technical rejections are usually the right call. The only exception is mailing lists, but the dozens of people who still use those can usually figure out how to add an exception for them.

The problems I noticed were, it doesn't matter what the SPF and DKIM look like. If Google or Microsoft refuse to relay your email based on secret internal factors then you're out of business.

This attitude is just FUD.

The issue here generally boils down to the defining difference between a generalist Admin and a Messaging Admin. The generalist can follow instructions, and nearly all the instructions out there stop at the point where SPF/DKIM/DMARC are successfully implemented. A generalist worth their salt will then fill in the gaps if they can', and knows this isn't where you stop when you want mail deliverability. There's a higher bar.

If you follow instructions written by non-professionals blindly you don't ever reach the point where you get to quality work.

Google, Microsoft, and the other large ESPs don't refuse to relay your email based on secret internal factors. This is what the non-professional people say to falsely justify why they can't do something.

Google and Microsoft publish the internal factors they use in the form of whitepapers at the industry working group. Its not ready made, and there are a lot of them, and they may not release their specific implementation details, but the metrics are there and often are based in weighted form (reputation-based systems).

If you follow them correctly, and set up the appropriate reporting accounts, and maintain those accounts, you won't have these problems. You generally only have problems once you've violated guidelines continuously, which happens when you rely on, or are unable to discern between qualified and unqualified help.

The factors are published at https://www.m3aawg.org/

Every professional that specializes in email or messaging that I know of is well aware of this.

People don't have the same vitriol when it comes to comparing Generalist Admins to DBAs, and this is the same with any specialized niche.

If you need email and messaging to work in a complex environment, you hire a person that specializes in it.

MS flat out refuses to unblock our IP on their "outlook protection" racket despite many attempts through their self-service website.

Our IP is the same for the last ... ~5 years now? Is it because we did not buy a /24? is it because we are so small they have no real reputation data? who knows!

In my experience, MS and others give you a chance to correct the issue and if you don't do so in a timely manner (which requires qualified help), or it isn't corrected, then you get blackholed thereafter, and will remain that way up to years afterwards.

There is very little interaction from them, they assume you'll be professional enough to read the published literature and act accordingly.

The literature is a way of adding cost to those that would send spam, it also adds cost in other ways.

If I had to guess without knowing more, assuming you've correctly configured yourself locally (which may not actually be the case), I'd say it could be because of your ISP.

In recent years, with the depletion and exhaustion of IPv4 address space, many ISPs have moved towards CGNAT, where multiple customers share the same IP transparently. The ISP may do this without you knowing, but you'd have to have constructive knowledge in some fine print.

Subsequently by extension, they share the same reputation characteristics for that portion as others on the same network. Residential IP blocks get heavily punished or outright blocked on both sides.

There isn't this problem with IPv6 (no CGNAT and its complications).

I've seen this a few times now; even when the business purchased the business tier service for a static IP. In the client's case there was fine print that mattered that they didn't read in their service/purchase agreement.

The telltale sign that this might be your problem usually requires discussions with your ISP, but if you can't get to a qualified person on the line (from the backend/T2 team) you can run a test.

Have your networking guys check the traffic outbound and inbound (from public facing node) with a connection/packets that uses decrementing TTLs with either ICMP or TCP packets to get a path that aggregates each hop. Tracert or equivalent.

See if it is appearing to be routed through bogon network address space before it hits the wider network.

There are reserved addressing for CGNAT, and if the traffic is being routed across those address ranges this may be a large portion of your problem. This is just one of many things someone that specializes in messaging knows a thing or two about.

Graduated vendor responses occur with messaging, when you have little sound reputation at the start, getting everything right matters. Commercial places warm their domains and IP addresses up slowly over the span of a month. If you send to a provider like gmail, you need to click open those emails as mail that never gets read affects reputation per the whitepaper (m3aawg).

If you don't follow the practices the industry publishes, they don't relay the traffic.

> who knows!

I should know because I've worked in this area for quite a long time. It really is not black magick, and it is a specialized niche for a reason.

>The literature is a way of adding cost to those that would send spam, it also adds cost in other ways.

It is an oversimplified way of evaluating of consequences of overwhelming control the two monopolists have over access of small providers to email services. And it leads to wrong conclusions at least in respect to the range of its influence. Yes, it makes difficult life for the small amateur spammers as strongly as for beginner administrators and service providers.

However while for the determined spammers to hire experts isn't a problem for small entrepreneurs and for non-profit personal activities it is a blocking barrier.

Of course, they can use the services of established providers with all the limitations and other disadvantages of such solutions or accept slavery joining millions of users and firms accepting full and unlimited control of MS and Google (to their undisguised satisfaction).

About the consequences of sudden and totally unexpected interruption of email services without giving reasons we all can read often enough.