Re:Email: Explained from First Principles
by KasparEtter on Monday February 20, 2023 @11:00AM
(#34869333)
Just to be clear: Due to email forwarding, having an SPF record isn't enough for domain authentication; you also need DKIM and DMARC. Mailbox providers want to deliver emails that people actually want to get, so not relying only on SPF records is a reasonable policy. But yes, thanks to domain authentication, we should be able to move away from IP reputation to domain reputation – at least in theory.
[ Parent
| on HN ]
Re:Email: Explained from First Principles
by lisper on Monday February 20, 2023 @11:42AM
(#34869801)
See my response here: https://news.ycombinator.com/item?id=34869796
Re:Email: Explained from First Principles
by efreak on Monday February 20, 2023 @05:45PM
(#34873933)
And setting up DMARC opens you up to an entirely new type of spam: corporate networks emailing you every time someone spoofs you. I had it set up for a short time before I quickly turned it back off.
Re:Email: Explained from First Principles
by KasparEtter on Tuesday February 21, 2023 @03:04AM
(#34878168)
For one thing, you can configure a DMARC policy without a reporting address. For another thing, you can use third-party services, such as https://dmarc.postmarkapp.com/, to aggregate DMARC reports for you (if you're fine with the privacy implications of that).
Re:Email: Explained from First Principles
by LeonM on Tuesday February 21, 2023 @05:05AM
(#34879105)
You can also just set up DMARC without a reporting endpoint. But DMARC aggregate reports are very useful, so I wouldn't recommend using DMARC without reporting. Also, you do not receive a report 'every time someone spoofs you', but rather periodically, at an interval which you can even configure.
That said, DMARC aggregate reports are not supposed to be human readable. You don't want to set the reporting endpoint to your personal inbox. You need a DMARC aggregation tool, such as included in https://www.mailhardener.com to process them. (full disclosure: I work there)