Re:You don’t want to be on Cloudflare’s naughty list
by 3np on Wednesday September 21, 2022 @01:22AM
(#32921087)
> It's trivially easy to spoof email addresses. Someone could sign you up easily, for example.
Proper DMARC configuration is table stakes to send e-mail, which makes that anything but trivial.
Re:You don’t want to be on Cloudflare’s naughty list
by viraptor on Wednesday September 21, 2022 @07:40AM
(#32923620)
But neither the newsletter host nor the email user has any input into how dmarc/dkim/spf are implemented. Only the user's email provider does. And if that's a small business domain, it's likely not very strict with the rules.
Re:You don’t want to be on Cloudflare’s naughty list
by namibj on Wednesday September 21, 2022 @11:12AM
(#32926275)
I thought DMARC/DKIM was necessary for delivering to Gmail for years now; in any case, there should be few who can't use a backup email to subscribe, as your newsletter won't be the only thing that has these anti-spoof requirements.
Re:You don’t want to be on Cloudflare’s naughty list
by viraptor on Thursday September 22, 2022 @12:57AM
(#32934942)
Not necessary. Just very highly recommended. I can still deliver my cron emails from a rando host successfully.
Re:You don’t want to be on Cloudflare’s naughty list
by namibj on Sunday September 25, 2022 @10:12AM
(#32971512)
That doesn't rule out DKIM, which only requires the `From:` header's domain to list a pubkey and the email to include a DKIM signature from a matching private key.
SPF is the one that regulates which hosts a domain's outbound SMTP servers are on.
It's also easy to send "from" an addresses that passes SPIF/DKIM but bounces inbound mail -- not sure what reason someone would have for this other than hurting the service reputation or acting as a DoS of sorts, but it can be done.