Hacker News

> The core problem is that the real need of email end users need is a way of determining whether or not to trust a given sender.

Which is only the core problem because dmarc fixed the other core problem of figuring out who the given sender is.

DMARC does not solve everything, but it does make other solutions more effective.

> virtually all the spam coming in had valid SPF / DKIM / DMARC, as do most of the phishing attacks.

This should create a means to go after the domain owners via registrar and trail of ownership, even so far as blocking email from the domain.

Forcing the spammers to pass DMARC creates a burden and an evidence trail that didn't exist before.

The primary purpose of DMARC is to prevent impersonation not to prevent spam. I own a domain, I implement DMARC to make sure others know when email from my domain is legitimately from my domain.

> The tech industry has a bad habit of providing solutions to problems adjacent to problems the user actually needs solved while leaving the user's actual problem unresolved.

Extremely well said.

My work email is Outlook, which is horribly broken and terrible to use. I have a rule configured to "re-send" all my mail to a different account where I read it with a usable MUA. Unfortunately this seems to break DMARC for external mail as now an email from e.g. user@example.com appears to have been sent by outlook.com.

My domain is very low traffic but, I just looked through my admin email account and opendmarc has rejected 18 attempts by spammers just this past week. More were rejected by my domain's DMARC policy.

^ this

Additionally, I would probably guess correctly that almost all spam comes from rotating ASNs these days. Aka from companies that do "growth marketing" or other bullshit that isn't a valid business but just... spamming people.

A lot of the domains that fall through the cracks for single-spam-campaigns have been taken over by botnet campaigns, so the actual owners of said domains probably don't know that their website is spamming everyone else.

But the major providers are the culprit, too, here. Gmail, hotmail, microsoft o365, mailgun ... they all don't even enforce SSL from server to server, and let through "sendmail" like spam because the spammers are paying customers to them.

Source: I am maintaining antispam [1] which I am using to combat spam, phishing, and malware campaigns targeting my customer networks.

[1] https://github.com/cookiengineer/antispam

I take the opposite approach, I refuse to whitelist domains. When someone internal complains I send a notice to their contact on the other end (CCing the internal recipient) saying their email is misconfigured and ask them to put me in touch with their IT department to help them fix it. I use a script to do some DNS lookups and write the email for me. I have about a 50% success rate getting them to fix it.

Yes! IMHO every registrar should be turning this on by default. Every DNS should do this by default until the owner explicitly turns on email sending.

It would solve a lot of issues globally.

Also consider (using your example domain):

  *.mydomain.io. TXT "v=spf1 -all"

I use postfix and the recipient_access file to control email to my domains which use little email, so the domains are able to process standard email:

admin@example.com OK postmaster@example.com OK abuse@example.com OK webmaster@example.com OK hostmaster@example.com OK info@example.com OK example.com REJECT example.com

LLMs are very good at helping you manage DMARC/DNS related configuration, even as a non-expert. I used it to develop custom DMARC report processing app that: 1. sucks in reports sent to our dmarc inbox into a sqlite db, 2. displays the results in a web page. The reports queue up in the mailbox and I open and start the app once a month to check the status. The agent also also reviewed the state of email-related DNS records, describe what needs to change, including how and why, and verify changes after the fact to ensure they are correct.

Some changes I made at the direction of an agent: fix domainkeys CNAMEs for M365, rotate M365 dkim keys that haven't been rotated for over a decade, fix broken spf record formatting.

My biggest issue is that squarespace refuses to enable dkim signing for transactional emails that they send for us (order/shipping confirmation etc). The email sending service they use (socketlabs) supports it but they are not interested in enabling the feature, so I can't lock down our dmarc. I guess that means squarespace is not a good fit for our needs; it's just disappointing that we have to move to a different platform again for technical reasons that are solvable with a dashboard switch.

You can do this right now, and you don't even need to fork anything. E-mail is an internet scale protocol that's not owned or ownable, except by convention. Since you specifically want to cut out Google, and their attempts to capture E-mail are what makes rolling your own E-mail hard anyway, just go for it.

Depending on how hard you want to make it, you can slap all the parts together yourself or use something like Zimbra, Mailcow, iRedMail, mail-in-a-box.

The advantage over a fork, whatever specifically that means, is any service that needs E-mail as an identity verification, still works.

Yes, email is just completely broken. It's not private, sender identification is mediocre at best (and nonexistent without things like DMARC and SPF), and all the kludges thrown up make self-hosting harder. Spam has zero cost basically also. Nobody trusts email anymore for anything confidential, it's become a clumsy notification service "come check our portal for your real email".

It's time for a new protocol with end to end encryption and sender verification built-in. That shouldn't be as hard as it sounds, because at the time when email was invented the internet was very different. Connections were intermittent, for example I would retrieve my email once a day with UUCP (and some other people would use batched-SMTP). Which means you could not rely on the sending and receiving server being able to communicate directly. In this day and age this is possible and that direct communication opens up a lot of better crypto like key generation algorithms which require both parties to be online at the same time.

The problem is, is you don't allow corpos you will break 95% of mainstream people's usecases. So I think this is a non-starter, unfortunately, though it is a lofty goal.

You can already do this without changing anything. Just set your corporate mailserver to not accept mail from common community email providers. There's a reason nobody does this, and it's because it's a bad idea.

There is so much crossover between personal email and corporate email.

No, email is the only digital communication left where I can talk to normie relatives AND businesses without having an account on normie tech service. DMARC does not impede that at all and it not a valid cause to throw away this lucky artifact of computing history.

What do you mean “fork”? Just buy a domain and install an email server.

It's ironic that I set everything up correctly on my self hosted domain and still end up in spam because of my low volume.

I even go to the trouble of registering in their Postmaster Tools and clogging up my DNS with their verification tokens all for the tools to tell me I don't send enough mail while they happily pass what little mail I send straight to spam.

  Not enough outgoing email
  You haven't sent enough email to personal Gmail (@gmail.com) accounts to determine deliverability status for your domain and messages.

Guess it doesn't help that as I look today the Postmaster Tools dashboard shows "Last updated Sun, Apr 26, at 9:30 AM."

Then on the other hand Google can flood me with spam filled Google Calendar Invites and Google Drive Share notifications, all fully DKIM signed because they are coming out of those services, all day long.

Microsoft have also recently changed their Smart Network Data Service (SNDS) so now only my cloud provider can access the console as they only allow verification to the owner of the whole ASN block you're under. I can't access detail about my domain anymore, and still my mail goes to junk. Unless you own a chunk of IPv4 ASN range you're out of luck. IPv6? Nope, not at Microsoft. "Please note that IPv6 is not currently supported." [1]

[1]: https://substrate.office.com/ip-domain-management-snds/SNDS/...

Email providers do have an automated way of handling abuse. Send the message to abuse@provider and they automatically ignore it. =)

Agreed, most spam has valid DMARC - whether that's bigmail.com or just nobodcarestoprotectsubdomains.randompwnedcompany.com

There are lots of free tools that automatically analyze the reports for you (you send it to them, instead of yourself).

But if you send all emails for your domain from one email server, you could just disable rua reporting. The reports are mainly useful to see whether you have some misconfigired email server somewhere that causes (or will cause) dropped emails. That can easily happen if you send some email from your own server, some via sendgrid, some via some marketing tool, and start to lose track of them. But for a personal email server, that's not common.

The reports are kind of useful when first enabling, if you want to get warnings about non-compliant mail, but after you're established, they're not really useful, so you should turn reports off, but you can do that without turning off the whole thing.

One awesome thing that SPF/DKIM/DMARC did... Now that spammers have "adapted", it means they can't say their email is from @mybank.com, or @microsoft.com, or @facebook.com, etc!

I'd expect the opposite really. Personal domains sending email are more likely to be run by MTA enthusiasts who don't have any money riding on others being able to receive their mails compared to corporate IT where mail is just one more thing they have to wrangle and really don't need the company leadership being angry at them because the spam-as-a-service company that marketing has been using without telling anyone gets blocked due to their DNS settings.

Technically you can receive mail without MX records if your mail server is on the same host as the web server.

DMARC is essentially an opt-in to strict mode. Primarily it prevents other people from forging email to look like it is coming from you. The goal of dmarc is to prevent other people from impersonating you.

Because if someone spoofs an email coming from your domain DMARC tells the receiver what to do with the spoofed email.

> What would be the benefit of setting up DMARC on top?

Some mail providers will junk your mail if you don't have a reject/quarantine DMARC policy because you're seen as enabling the spammers so everything out of your domain must be punished.

The biggest benefit I saw in a small domain was greatly reduced backscatter spam. Before someone’d randomly make up a billion emails on my domain and send “from” them, and I’d get various out of office replies, etc (catch all) - that basically never happens anymore.

68.4% still don't enforce it, i.e. adoption is just over 30%, not nearly 70%.

You misunderstood, it's 31.6% actually.