You can set your policy to reject, that will deter the Russians from using your domain.
I doubt Russian spammers will care about the difference to be honest. If they accept that their email will be delivered to spam folders, why would they care that the email gets silently dropped? In neither case anyone is going to fall for them.
Security: "We had to cancel every single one of those sales because they came from stolen credit cards. It's costing us more to deal with that then we are earning"
I’ve abandoned that role and have gone back to an IC role and I’m much happier for it.
If you do it this hacky way - we run this risk and this bad thing can happen etc. After a few times they see the consequence of their decisions people start paying attention to you. Do it a few more and now the company will have an "institutional knowledge" that you are usually right, and even if the manager leave, you still end up like the go-to guy on how to ship.
And sometimes the marketing people might end up being correct! I've once actually battled to "do the correct thing" (way back in the day it was a ruby on rails modeling I think) and the product owner was like - just do it this hacky way I don't care ... I did it the hacky way and you know what - it was the right call - we never changed it again and the business knowledge we got from it was actually valuable.
I'm pretty bitter about it all still, but it's a combination of a lot of things beyond this particular bit I shared. All I can say is I'm glad I am no longer in that role, it was slowly killing me.
Now that said, I've worked with a lot of IT/engineering people who are pretty obstructionist to normal business operations and sometimes need to be told, "yeah, we're accepting the risk, move forward with the plan." Sometimes it's for good reasons, other times it's just our normal humanity asserting itself in different ways. It's a hard problem for sure.
Marketing should get their own (sub)domain for sending their missives, that way the primary corporate domain's reputation is not harmed.
Unless you want to run the risk of outgoing e-mails from Finance / Accounts Receivable to be sent to other companies' Junk folder.
There's a difference between one and dozens, and even between one dozen and dozens.
Most companies are not of Microsoft's size either: just having news.example.com would probably be sufficient for a lot places.
I ran into this helping a friend whose biz emails to gmail recipients were getting dropped; the IT dept of the umbrella corp wouldn't respond. Same to me when I sent the correct DMARC, SPF etc.
(My friend's biz was his own but it shared some resources with a larger corp.)
I eventually realized that the (wrong) DMARC reporting domain wasn't even registered. I did what you'd expect and I soon had DMARC reports for subsidiaries of the umbrella corp. My friend passed that up to the CEO and suddenly IT was responsive.
In the end, it turned out that IT was deliberately blocking his biz emails to his biz family members. After 10 years they suddenly decided that email to family+gmail was risky and that they were going to gaslight my friend about it. Because reasons.
I’ve run into outright malicious stuff internally like this, but never externally - I would probably go apoplectic if I was your friend
For what it's worth, I've started seeing cybersecurity insurers requiring riders and extra payments if you don't block Russian IPs.
Those "London oblast" jokes don't come from nowhere.
If that's not it, you an see which database maps your IPv6 range to Russia and contact them to ask them to change it.[3]
Of course, if you have accounts with a Russian addresses, then things will revert.
[1] https://tunnelbroker.net/export/google
Unless you own a global business, i see no reason to even allow other countries access. The potential for attacks is too great, especially from some very specific countries.
My bank had some technical problem that prevented access from overseas last time I traveled and I couldn't access my account (which was extremely inconvenient).
You never see or collect the information by blocking everything at the outset.
In a world where you can proxy past these blocks fairly trivially, that's information you don't have for attribution later.
Defense in depth, or layered defenses are a best approach, but not if they blind you equally.
Russia, China, Nigeria, Romania, North Korea, Iran and Belarus [1]?
[1] https://www.ox.ac.uk/news/2024-04-10-world-first-cybercrime-...
Using your link: Ukraine, USA, UK, Brazil, & India all rank higher than Iran and Belarus. US & Ukraine rank higher than Nigeria and Romania.
https://ofac.treasury.gov/sanctions-programs-and-country-inf...
It probably makes sense to leave the US out of the list, assuming the CableNinja is in North America.
The rest seems pretty arbitrarily chosen, though. JumpCrisscross gave no additional context to why they left out Ukraine, Brazil, India, UK, when picking countries from the list they linked. They have higher cybercrime index ranks.
Whether they have a higher chance of "real" traffic is highly dependent on the business in question.
I'm sure there is some amount of thought behind the choice, beyond just using the index, which is why I'm asking.
do you also log everyone who looks at your house? it's a self inflicted problem
If you set DMARC to report, you’ll get notices from remote email systems when they receive noncompliant emails with your domain in the Envelope From field. Those reports are where you’ll see Russian IP addresses show up when they are trying to spoof your emails.
But there is no way to block them because neither the senders nor receivers are on your infrastructure. The best you can do is set a reject DMARC policy and hope everyone follows it.
I don’t understand why Microsoft are so bad at this?
They have access to a large percentage of all email traffic to train domain reputation, and spam detection models on yet seem to be notorious for both false positives and false negatives.
Google’s spam filters are far more accurate.
More specifically they seem to rely IP reputation rather than domain reputation, and IPs do change hands, especially for smaller servers.
The issue here generally boils down to the defining difference between a generalist Admin and a Messaging Admin. The generalist can follow instructions, and nearly all the instructions out there stop at the point where SPF/DKIM/DMARC are successfully implemented. A generalist worth their salt will then fill in the gaps if they can', and knows this isn't where you stop when you want mail deliverability. There's a higher bar.
If you follow instructions written by non-professionals blindly you don't ever reach the point where you get to quality work.
Google, Microsoft, and the other large ESPs don't refuse to relay your email based on secret internal factors. This is what the non-professional people say to falsely justify why they can't do something.
Google and Microsoft publish the internal factors they use in the form of whitepapers at the industry working group. Its not ready made, and there are a lot of them, and they may not release their specific implementation details, but the metrics are there and often are based in weighted form (reputation-based systems).
If you follow them correctly, and set up the appropriate reporting accounts, and maintain those accounts, you won't have these problems. You generally only have problems once you've violated guidelines continuously, which happens when you rely on, or are unable to discern between qualified and unqualified help.
The factors are published at https://www.m3aawg.org/
Every professional that specializes in email or messaging that I know of is well aware of this.
People don't have the same vitriol when it comes to comparing Generalist Admins to DBAs, and this is the same with any specialized niche.
If you need email and messaging to work in a complex environment, you hire a person that specializes in it.
Our IP is the same for the last ... ~5 years now? Is it because we did not buy a /24? is it because we are so small they have no real reputation data? who knows!
There is very little interaction from them, they assume you'll be professional enough to read the published literature and act accordingly.
The literature is a way of adding cost to those that would send spam, it also adds cost in other ways.
If I had to guess without knowing more, assuming you've correctly configured yourself locally (which may not actually be the case), I'd say it could be because of your ISP.
In recent years, with the depletion and exhaustion of IPv4 address space, many ISPs have moved towards CGNAT, where multiple customers share the same IP transparently. The ISP may do this without you knowing, but you'd have to have constructive knowledge in some fine print.
Subsequently by extension, they share the same reputation characteristics for that portion as others on the same network. Residential IP blocks get heavily punished or outright blocked on both sides.
There isn't this problem with IPv6 (no CGNAT and its complications).
I've seen this a few times now; even when the business purchased the business tier service for a static IP. In the client's case there was fine print that mattered that they didn't read in their service/purchase agreement.
The telltale sign that this might be your problem usually requires discussions with your ISP, but if you can't get to a qualified person on the line (from the backend/T2 team) you can run a test.
Have your networking guys check the traffic outbound and inbound (from public facing node) with a connection/packets that uses decrementing TTLs with either ICMP or TCP packets to get a path that aggregates each hop. Tracert or equivalent.
See if it is appearing to be routed through bogon network address space before it hits the wider network.
There are reserved addressing for CGNAT, and if the traffic is being routed across those address ranges this may be a large portion of your problem. This is just one of many things someone that specializes in messaging knows a thing or two about.
Graduated vendor responses occur with messaging, when you have little sound reputation at the start, getting everything right matters. Commercial places warm their domains and IP addresses up slowly over the span of a month. If you send to a provider like gmail, you need to click open those emails as mail that never gets read affects reputation per the whitepaper (m3aawg).
If you don't follow the practices the industry publishes, they don't relay the traffic.
> who knows!
I should know because I've worked in this area for quite a long time. It really is not black magick, and it is a specialized niche for a reason.
It is an oversimplified way of evaluating of consequences of overwhelming control the two monopolists have over access of small providers to email services. And it leads to wrong conclusions at least in respect to the range of its influence. Yes, it makes difficult life for the small amateur spammers as strongly as for beginner administrators and service providers.
However while for the determined spammers to hire experts isn't a problem for small entrepreneurs and for non-profit personal activities it is a blocking barrier.
Of course, they can use the services of established providers with all the limitations and other disadvantages of such solutions or accept slavery joining millions of users and firms accepting full and unlimited control of MS and Google (to their undisguised satisfaction).
About the consequences of sudden and totally unexpected interruption of email services without giving reasons we all can read often enough.
You are warned before you are outright banned. It shows up in the logs if you actually set that up properly.
It only appears like they cut you off because you ignore the things professionals pay attention to. Allowing an amateur to create and impose a problem and loss for other business is beyond stupid.
If you lack the expertise and context, you have no business dictating how things ought to be, and rabble rousing is vile.
>If you lack the expertise and context, you have no business dictating how things ought to be, and rabble rousing is vile.
Your response seems to be typical for persons who are right because they are right - no args related to the content you respond to and ad personam args instead.
It was unclear, and the ISP wasn't giving us much, it took months to track down and some really clever networking tests. The Network Engineer really came through there in collecting the info we needed to have a discussion with the ISP. I mention it to save others the headache, and labor involved.
Going IPv6 native corrected a whole host of issues.
That's a pretty wild take. Was there no alternative ISP?
It was buried in the fine print related to IPv4 exhaustion.
The CFO I was working with was as flabbergasted as I after we'd found out, but I've seen it a few times now, even when there is another option because of a duopoly in an area.
>If you don't follow the practices the industry publishes, they don't relay the traffic.
They are sending us email, we forward it, Gmail throttles it because it looks like spam, and then they don't accept the bounce for example :)
> I should know because I've worked in this area for quite a long time. It really is not black magick, and it is a specialized niche for a reason.
It's not black magic, it's abuse of market power.
They had at one point a persistent downgrade in mail reputation to the point where it was almost impossible to keep a working mail server with them that would be accepted by any major ESP.
They weren't particularly receptive to addressing support issues where their systems were breaking guidelines/RFCs impacting reputation, at least when I spoke with them about one of my servers a year or so back (which I promptly migrated to another provider).
From what I understand, there were egregious issues. Some of the rumors included source address validation not being done allowing DDOS and spoofing originating from these shared servers on the network block, issues with published PTR records, and a few other things. All of which heavily contribute to mail deliver-ability issues.
> They are sending us email, we forward it, Gmail throttles it because it looks like spam and then they don't accept the bounce for example.
If you are acting as a relay and forwarding mail from Google, to another Google recipient, you need to follow the mandatory guidelines.
https://support.google.com/a/answer/81126?hl=en
Naive relaying or forwarding can/will clobber headers, modifying the from header will also set off reputation issues. If you forward you need to be using ARC headers. The milter is a total pain to set up, validate, and get working.
High volume sending also has stringent requirements. You can read all about it at that link.
MSFT sends to us but then they don't accept anything from us, not even bounces to their own mail.
Relay between gmail addresses works fine. (ARC is enabled and working for years? ... since rspamd supports it. [though it had mysterious bugs initially, so I spent quite some time with it.])
> The milter is a total pain to set up, validate, and get working.
yes :D
especially the sender rewriting one.
> High volume sending also has stringent requirements.
yep, and it makes sense! though we're nowhere near that.
thanks again for your detailed replies!
The reasoning you provide doesn't differentiate, and speaks more of frustration which naturally comes with any area you aren't steeped in, or knowledgeable about.
"I don't know" is not a problem, you learn and you know, no frustration.
The problem is "I spent N hours/days on a thing that everyone does and which is a 99.99% of use cases and boils down to just having a keyfile in a proper(?) location and this knowledge doesn't translate effing nowhere".
would you say the same about DBA operations or would you say that's just not my specialty
It depends on the absurdity of the complexity of setting something up, not on operations themselves. Getting some results is absurdly complex -- not naturally complex and not necessarily very complex, just much more complex than the nature of the result itself.
For example, that's how you were supposed to install openvpn before angristan scripts: https://www.digitalocean.com/community/tutorials/how-to-set-... . To save someone a click, it's 50 pages "installation tutorial" with around 50 commands and a dozen of config files. And guess what, it uses "easyrsa" package to "set up RSA PKI easily". So it's not how openvpn meant to be installed, but an "easy" way.
There are critical tools that you clearly have not learned, and likely were never taught. Tools that have been around since the time of the Greeks.
This is evident in your use of poorly defined language running you indirectly in a circular path (trauma/torture loop).
There is irreducible complexity in software. Domain knowledge is needed to use complex software for purpose.
The script you say makes assumptive choices for you. What will you do now that RSA has practically become broken at small key sizes, and instead you need to use a different algorithm?
Do you know how to transition this without starting from scratch, or have you become corrupted by dependency, on someone who provided that for you that did have that knowledge? Are you helpless to do anything but wait.
If you want to correct the underlying reason for your troubles, I'd suggest going over the associated material covered in a Trivium based curricula.
It will require unlearning bad heuristics and re-learning good heuristics. It requires a lot of effort and constant attention until you've got your thought processes fixed and these provide the basics for rational thought.
You should have been taught these things in school.
Logic (Aristotle), Philosophy (metaphysical objectivity, identity and its requirements), Argumentation, Descartes Method, and Kant with regards to A priori knowledge, reasoning, and argumentation.
Small things with an outsized bigger impact.
If you can't understand what is written in the whitepapers, you have no hope of following the conformant requirements.
Software reduces to practice the requirements of business logic, which is described in those whitepapers.
Sometimes its irreducible, and you have to approximate, and they won't hand this ready-made to people that aren't willing to put the time cost and professional skill needed to do so correctly.
You have to offer tribute, in the form of expertise, and time to benefit from these systems. As you have to do for any other specialized career.
You mistake the environment you are in, and where it is going, which will threaten your ability to survive at some point as you are helplessly dependent on an environment that will cease to exist in the near future.
This was neither toxic, nor arrogant, just the facts and advice provided in good will and faith, something that is vanishing along with tolerance, and those facts should frighten you because they have detrimental outcomes as a consequence for you.
You didn't want to hear it because of indoctrination, and an inability to to comprehend. As a result, you have only yourself to blame for the choices you've made and what predictably comes next. Struggle and frustration.
Those that can't help themselves won't be helped by others. Those that cannot learn and adapt doom themselves by their own choices. Darwin's fitness.
A time is coming where the blind in their unpredictable and crazy behavior may be given a final mercy that can't be taken back, for the good of all because these people are a detriment to all if left alone. Historically, this is well known and it wasn't until modern times that we had the resources to care for such illness in seeming perpetuity.
Until things change, you've made it clear the only path for you is to struggle on needlessly, without any help, and let it distort you in a spiral of madness until you succumb to your self-fulfilling prophecy and break moreso than you already have.
Slapping goodwill and advice down falsely believing its toxic, when in fact its just unpleasant/harsh truths you weren't strong enough or willing to face speaks greatly to the character and outcomes you will face.
There are people who happen to know more than you do, about a great many things; because you were given a poor foundation purposefully. Its not arrogance to want to give people the opportunities that an education they should have been given as a child provides. The alternative is delusional adult children running amok destroying the pillars of their own survival.
You tread forward down the path those malevolent people laid for you, deceived, and never straying; biting any hand that offers help. Its sad because its preventable and needless.
I'll pray you revisit this when you get tired of the madness you put yourself through.
Your response is that he ought to read the standards and implement things himself. That the frustration is due to a skill issue, not to deficiencies in the software.
Or do I misunderstand?
I feel like the only thing missing here is the recommendation to do it all in assembler. To "build character" or something.
I suppose that technically you're correct, in the sense that if he were more skilled he likely wouldn't be as frustrated. Such an observation hardly invalidates the complaint about poorly designed software though.
There's nothing wrong with someone who wants to roll their own but most people most of the time want an out of the box solution. It's inevitable given the level of complexity involved in the modern tech stack. Building all of it from scratch by yourself simply isn't realistic.
You have to understand the tasks themselves are not and cannot ever be simple because of the adversarial nature imposed by bad actors.
You can point at a small component piece and say that's a simple task, but taken in the full real working context its not at all simple because there were other requirements that were ignored when viewed in isolation that are crucial to continued function in a useful way.
The frustration is due to a skill issue, anyone that could set a system up without issue would, and there would be no frustration if that were the case.
Importantly also, this isn't a software problem, its a problem that cannot ever be completely solved by software. There are problems that computation simply cannot solve directly. This is one of them. Its touched on in Automata theory under the Limits of Computation.
Anytime you have two different underlying states whose structure is identical when examined (a single state that cannot be differentiated) it falls into one of these type of problems. Reputation systems are a form of approximation for hidden state systems used to differentiate in such cases by skewing it so those that those who abuse the system are limited and quarantined, whereas those that don't can use the system. The hidden states are required to make these systems work and retain usefulness.
The alternative is no communication at all because resources a limited, and the SNR doesn't allow differentiation putting that cost on every reader who will stop using such systems because it makes them useless and the cost is unreasonable.
The requirements and cost that result from implementation of the whitepapers requirements keep the systems useful. Not everyone should be running their own server largely because they aren't appropriately qualified to fulfill their responsibilities and obligations in doing so, and as a result of that lack of expertise cause issues for other businesses imposing cost when they are allowed to do so.
The alternative, having no requirements is having no messaging at all. You literally can't have it both ways.
The complexity involved is why Messaging and Email Systems are their own subspecialty within IT.
> Building all of it from scratch by yourself simply isn't realistic
You don't build it all from scratch. You configure the software someone else built from scratch appropriately to meet the implicit requirements to interoperate or you don't, and the consequence of failure is mail doesn't get accepted for those recipients at that provider.
As I said, non-professionals writing tutorials making it seem like this is simple, and people blaming their own ignorance on others; is where all the hardship is coming from.
It isn't simple at all, if it were an average child could do it.
I can tell you from experience, nearly every single postfix stack that I've walked onto the job and seen at a small business, lacked critical functionality in their configuration with only a single exception in a decade. That's thousands of instances that required standing up new infrastructure correctly, and they didn't have issues after that.
In nearly all of those cases a non-professional got hired, lied about their experience, and then set them up for failure and they got what they paid for, but didn't know it at the time.
It could have been set up correctly if the people were qualified, but they weren't and it wasn't, and its an ongoing cost because requirements change over time, when they change you change, or your system stops working.
Things like auditing and logging, rate limiting, alerting, migration, features like list-unsubscribe, and many other requirements... etc.
Most cases, people stop the configuration at the point where an email technically goes out and they call it a day, up until calamity strikes because they didn't pay attention to important things.
There are people who pay for the advice and are told months in advance if you keep doing this you'll wake up one day unexpectedly and find no email can go out, and they don't stop. They have to learn it the hard way.
Imposter syndrome is a thing in the industry, but there are also a lot of imposters pretending to be professionals as well.
I'll also agree that there are systems which exist that for whatever reason can't realistically be simplified.
However, on what basis do you claim that email - or rather email anti-abuse - qualifies as such?
> The alternative, having no requirements is having no messaging at all. You literally can't have it both ways.
You seem to be implying that the usefulness of the system derives from or otherwise depends on the difficulty of configuring it. However it doesn't seem to me that you've provided evidence of that. On the contrary, isn't the entire point of a reputation system that it avoids such gatekeeping by depending on historical behavior rather than some arbitrary barrier to entry?
I would make my own claim. That there exist software implementations that are far more complex than they realistically need to be, often because the thing being implemented has evolved over time and the resources or motivation or whatever needed to re-engineer and rewrite the implementation aren't available.
I would also claim that sometimes software has shitty UX for no better reason than the person developing it doesn't understand the needs of (some subset of) the people using it.
When configuring a network node to exchange messages in a really quite primitive protocol requires professional expertise to do correctly I'd say that's a clear indication that something is very wrong somewhere in the stack. Where exactly is certainly up for debate but a well behaved entity should not find it difficult to self host such basic functionality.
Boiling it down, it comes down to system properties that are preserved, and Von-Neumann Architecture acts as a DFA. Computers act on a single state at any one time, moving only ever one edge on a abstract state graph at each operation.
People generally are considered NFAs that can operate on multiple states and decompose states, and have a wider range of problems in the types of problems we can solve.
This is abstract but the gist is, the computer follows an abstract rail of decisions that is really quite dumb, but necessarily so, and it doesn't halt or runaway except with bugs, because we preserve properties limiting the math to areas where it cannot have the problems except outside the working environment (i.e. power loss, hardware failure etc).
There's a reduction to an abstract algebra system inherent in the architecture by preserving certain properties in the design.
Any time you have an underlying state that is both true and false given the same state, the property requirements for computation are broken. This can naturally occurs in any communication system, and the hoops we have to jump through that we add on in the form of requirements is defining a way to differentiate that hidden state indirectly by the presence of the requirements which good actors follow more closely than bad actors. This is decomposing the state in structure from an NFA type problem to a series of DFA type problems as I'm sure you might recall from your Compiler Design Courses (if you've taken them), or learned from the Dragon Book.
Any message sent must be sent in an identical structure. Any bad actor will adapt to ensure their messages get sent through flooding and raising the noise floor. Any good actor will adapt in a number of ways sometimes by no longer using a system that doesn't provide benefit. You can only operate on the same state.
If you can only process and interact with the message structure itself. No computation system will ever be able to skew what is sent or received so that only the legitimate messages are sent, and the illegitimate ones aren't. Everything goes through the same point. With everything going through, the noise floor is so high nothing gets through, and communication is the sharing of meaning/signal between two parties, people adapt and abandon the system for systems that work.
The core issue is a fundamental computer science issue.
When a computer hardware system first boots up, the bringup stage in hardware sets up the constraints needed to do work. Ask yourself what about the design of computers today prevents the classic unsolved computer science problems and you'll find this staring back. Halting and Decidability (usually).
There are impossible to solve problems, because we've proven that math is incomplete, which impacts on decideability.
Computers work on specific principles, and when you don't understand or know how those work you can easily jump to magical conclusions that simply do not work or have a basis in reality.
A very simple example of this same problem demonstrates this. You are given two spreadsheets without distinct (unique) names. You have 10,000 rows of employees, and you have a list to deactivate 400 people's accounts in an hour, the list of people to be deactivated is by name. You have a script to do all that's necessary for that for individual accounts given a specific account, but some of those people's names are identical to others, and they are different people. The first match you happen to see is the CEO.
How do you solve this?
If you pass the names to automation blindly, you'll deactivate people's accounts that should not be deactivated and you get fired. If you don't in the time period alotted, your fired. How do you solve this?
The only possible way to solve this given the constraints is you ask for a list that includes a unique identifier for the people that need to be deactivated, and a matching list to work from and then the automation can work.
If you just did it blindly, the computer would do it blindly. It has no way to know otherwise.
There is no other way that does not result in you being fired. Fuzzy matching doesn't work because without the identifier you know that one of those two or three needs to be deactivated but you don't know which, and getting it wrong ends in you being fired. This type of problem is called decidability.
You get the same types of this subtle problem all over automation in different forms. Like in Linux with ldd's output, which is why it fails silently when passed to any automation. The overloaded null state means two different things, and its undecidable when it flattens, and if you examine it carefully it breaks regular expressions. Why? That property isn't preserved.
You are used to dealing with the top of the stack where these properties are preserved, unless you break them with a bug.
- spammers have 1 system to set up in order to spam. They get it right.
- company admins have dozens of projects, of which this is a tiny one, with zero ROI to the bottom line (if people don't consider how critical security is). So they delay.
- companies often have dozens of systems integrated, when I set up DMARC/DKIM the first time for my company, a bunch of email tools broke, we had to do a bunch of leg work, took us a month end-to-end. The value was recognized when we almost lost 20k to a "ceo emails you" scam. But until then it wasn't a priority.
- we didn't even have a full IT, i just stepped in because I cared enough.
- my current company has a dedicated security team. These holes are plugged VERY quickly.
It makes sense that people whose business is sending email know how to set up email correctly. I'm mostly surprised at how many legitimate sysadmins struggle with getting the basics correct. Surely those dozens of DMARC emails you get that your sendgrid email has been refused because of a bad SPF signature should set in motion some kind of plan to ask if maybe marketing is using them legitimately?
Automated signatures are of limited value but I rarely see rejections based on SPF and DKIM that are a mistake. Things are probably worse for big organizations but as a small email server, technical rejections are usually the right call. The only exception is mailing lists, but the dozens of people who still use those can usually figure out how to add an exception for them.