News for hackers. Stuff that matters.

A comment on How Spam Filtering Works: From SPF to DKIM to Blacklists. Parent comment

Re:How Spam Filtering Works: From SPF to DKIM to Blacklists by mehrdadn on Friday September 07, 2018 @10:50AM (#17934659)
The new hotness is ARC (arc-spec.org), which I understand came out of DMARC? Not sure though, don't know too much about it.

For DMARC, it's not so awesome :\ https://news.ycombinator.com/item?id=17900765

[ Parent | on HN ]
Re:How Spam Filtering Works: From SPF to DKIM to Blacklists by massaman_yams on Friday September 07, 2018 @02:19PM (#17936473)
In short: ARC builds on top of DMARC to fix some cases that DMARC didn't handle well. (And DMARC, in turn, builds on top of DKIM and SPF.)

DMARC is overall a very good thing, and has significantly cut back on the effectiveness of forged email for spam/phishing, at the expense of mailing list/forwarding headaches.

[ Parent | on HN ]
Re:How Spam Filtering Works: From SPF to DKIM to Blacklists by mehrdadn on Friday September 07, 2018 @05:00PM (#17937597)
Hopefully it's been good for other people... I haven't seen any benefit personally. :\

On a related note: do you know if DMARC feedback leaks information to the sender on whether or not you opened an email, or reported it as spam, or similar? If so, do you know why this isn't considered a privacy or security issue?

[ Parent | on HN ]
Re:How Spam Filtering Works: From SPF to DKIM to Blacklists by Ionlyprograminc on Friday September 07, 2018 @08:01PM (#17938569)
DMARC feedback is only based on the MTA (Message Transport Agent) handling the mail. I don't have much experience with DMARC reports but Senders typically use it when they are first Setting up DMARC. It is up to the receiving MTA to send the inbox/spam result according to the RFC. I think that the reports are aggregated so single inboxes are not able to be detected. I don't think many people actually send / follow up on DMARC reports imo.

Source: https://tools.ietf.org/html/rfc7489#section-7.3

[ Parent | on HN ]
Re:How Spam Filtering Works: From SPF to DKIM to Blacklists by massaman_yams on Monday September 10, 2018 @01:05PM (#17953236)
Recipient activity is not part of DMARC, so there are no concerns there.
[ Parent | on HN ]
Re:How Spam Filtering Works: From SPF to DKIM to Blacklists by gorkish on Friday September 07, 2018 @06:05PM (#17938008)
DMARC is for the sender ARC is for the receiver/intermediary. The problem with DMARC (really it's not a problem with DMARC but we'll play like it is) is that if you do something like set up a Gmail account to forward mail to your "real" yahoo account then yahoo might not accept the message from Gmail since from yahoo's perspective Gmail is trying to dump a forged message into your box that they didn't originate. As a sender I don't really give a shit that the other end is broken by some lazy person.
[ Parent | on HN ]
Re:How Spam Filtering Works: From SPF to DKIM to Blacklists by mehrdadn on Friday September 07, 2018 @06:23PM (#17938113)
How is the message considered forged when it passes DKIM though?
[ Parent | on HN ]
Re:How Spam Filtering Works: From SPF to DKIM to Blacklists by Ionlyprograminc on Friday September 07, 2018 @07:55PM (#17938526)
A message can still be considered a DMARC failure since the check depends on both SPF and DKIM. You can have various failures like recipient rewrites and general SPF/DKIM failures which will fail DMARC a significant amount of the time.
[ Parent | on HN ]
Re:How Spam Filtering Works: From SPF to DKIM to Blacklists by Alex3917 on Friday September 07, 2018 @11:28AM (#17935010)
Basically mailing lists break DKIM signatures, and ARC fixes that. It also fixes certain types of automatic message forwarding, e.g. when you have account forwarding turned on, not when you hit the forward button.
[ Parent | on HN ]