Spammers are better at SPF, DKIM, and DMARC than everyone else

Re:Spammers are better at SPF, DKIM, and DMARC than everyone... by CableNinja on Tuesday March 25, 2025 @09:30AM (#43471030)

Ive got a server hosting a number of things, amd monitoring setup for a lot of stats. Got tired of seeing blips because various countries were beating on my server, not a DoS, but enough requests to notice, and sometimes generate an alert. I blocked 7 countries, in full, and the impact was fantastic. No more 2gb of logs generated every day by countries that have no business accessing my server.

Unless you own a global business, i see no reason to even allow other countries access. The potential for attacks is too great, especially from some very specific countries.

[ Parent | on HN ]

Re:Spammers are better at SPF, DKIM, and DMARC than everyone... by smithkl42 on Tuesday March 25, 2025 @09:52AM (#43471322)

I'm the CTO of a US-based insurance company. Apart from some reinsurers in London and Bermuda, and a couple contractors in Canada, we don't do business outside the US. We've blocked all countries except those, and it has cut down massively on the folks attacking us.

[ Parent | on HN ]

Re:Spammers are better at SPF, DKIM, and DMARC than everyone... by elcritch on Tuesday March 25, 2025 @10:33AM (#43471833)

Lots of companies do this on their websites now using cloud flare or something similar. It’s practical. Still it’s frustrating as a user when you’re traveling over in Europe and can’t access your accounts to pay bills or whatnot.

[ Parent | on HN ]

Re:Spammers are better at SPF, DKIM, and DMARC than everyone... by robocat on Tuesday March 25, 2025 @10:52AM (#43472068)

Next time I travel overseas I'll have a VPN ready.

My bank had some technical problem that prevented access from overseas last time I traveled and I couldn't access my account (which was extremely inconvenient).

[ Parent | on HN ]

Re:Spammers are better at SPF, DKIM, and DMARC than everyone... by gabeio on Tuesday March 25, 2025 @12:15PM (#43473007)

[delayed]

[ Parent | on HN ]

Re:Spammers are better at SPF, DKIM, and DMARC than everyone... by elcritch on Tuesday March 25, 2025 @11:08AM (#43472262)

Commercial VPNs are often blocked too. I found a p2p vpn to my home network + ssh socks5 proxy to work well.

[ Parent | on HN ]

Re:Spammers are better at SPF, DKIM, and DMARC than everyone... by ZeroTalent on Tuesday March 25, 2025 @01:18PM (#43473634)

Kinda similar, but when I looked at the finances, I was surprised by how much money we're getting from places like the Cayman Islands, Switzerland, and the Emirates.

[ Parent | on HN ]

Re:Spammers are better at SPF, DKIM, and DMARC than everyone... by trod1234 on Tuesday March 25, 2025 @06:32PM (#43476777)

Have you considered the additional cost of making it harder for your customers to do business with you, as well as the limited visibility that you set up for attacks that may become multi-stage in nature later?

You never see or collect the information by blocking everything at the outset.

In a world where you can proxy past these blocks fairly trivially, that's information you don't have for attribution later.

Defense in depth, or layered defenses are a best approach, but not if they blind you equally.

[ Parent | on HN ]

Re:Spammers are better at SPF, DKIM, and DMARC than everyone... by UltraSane on Wednesday March 26, 2025 @01:26AM (#43479119)

As someone who has whitelisted only US IP address space for my employer and blocked everything else I can attest that is DRASTICALLY reduces hostile traffic to us. I have an RDP honeypot that was blocking dozens of IPs every day before the whitelist and now it blocks 1 or 2 a day.

[ Parent | on HN ]

Re:Spammers are better at SPF, DKIM, and DMARC than everyone... by JumpCrisscross on Tuesday March 25, 2025 @09:31AM (#43471056)

> I blocked 7 countries

Russia, China, Nigeria, Romania, North Korea, Iran and Belarus [1]?

[1] https://www.ox.ac.uk/news/2024-04-10-world-first-cybercrime-...

[ Parent | on HN ]

Re:Spammers are better at SPF, DKIM, and DMARC than everyone... by ziddoap on Tuesday March 25, 2025 @09:54AM (#43471351)

How/why did you pick these 7?

Using your link: Ukraine, USA, UK, Brazil, & India all rank higher than Iran and Belarus. US & Ukraine rank higher than Nigeria and Romania.

[ Parent | on HN ]

Re:Spammers are better at SPF, DKIM, and DMARC than everyone... by edm0nd on Tuesday March 25, 2025 @11:25AM (#43472466)

We (a US org) block all countries listed on the OFAC list

https://ofac.treasury.gov/sanctions-programs-and-country-inf...

[ Parent | on HN ]

Re:Spammers are better at SPF, DKIM, and DMARC than everyone... by kasey_junk on Tuesday March 25, 2025 @10:03AM (#43471467)

Those countries likely have a higher chance of real traffic as well. If I’m doing business in Nigeria then obviously I can’t block it even if it ranks high on the threat level.

[ Parent | on HN ]

Re:Spammers are better at SPF, DKIM, and DMARC than everyone... by ziddoap on Tuesday March 25, 2025 @10:11AM (#43471581)

Yes, obviously you don't block the countries you plan to do business with. I got that much.

It probably makes sense to leave the US out of the list, assuming the CableNinja is in North America.

The rest seems pretty arbitrarily chosen, though. JumpCrisscross gave no additional context to why they left out Ukraine, Brazil, India, UK, when picking countries from the list they linked. They have higher cybercrime index ranks.

Whether they have a higher chance of "real" traffic is highly dependent on the business in question.

I'm sure there is some amount of thought behind the choice, beyond just using the index, which is why I'm asking.

[ Parent | on HN ]

Re:Spammers are better at SPF, DKIM, and DMARC than everyone... by aftbit on Tuesday March 25, 2025 @10:54AM (#43472105)

Let me throw out a guess: Ukraine is a wartime ally, Brazil is the seventh largest country in the world, India is the first, and the UK speaks English and has a lot of connections to USA.

[ Parent | on HN ]

Re:Spammers are better at SPF, DKIM, and DMARC than everyone... by JumpCrisscross on Tuesday March 25, 2025 @11:13AM (#43472342)

They're each also popular IT outsourcing destinations who aren't sanctioned. You may not do business in Ukraine or Brazil, but chances are one of your customers or contractors do, and blocking those IPs isn't usually in the first or second swipe. (If you're blocking the UK and India, you're probably blocking all foreign IPs.)

[ Parent | on HN ]

Re:Spammers are better at SPF, DKIM, and DMARC than everyone... by CableNinja on Tuesday March 25, 2025 @07:33PM (#43477230)

Pretty close tbh. Sub romania for brazil, and nigeria, for... i dont remember right now

[ Parent | on HN ]

Re:Spammers are better at SPF, DKIM, and DMARC than everyone... by throwaway2037 on Wednesday March 26, 2025 @01:42AM (#43479195)

Romania!? I did a double-take, as it is a member of the European Union. I would think if their cyber-reputation was so terrible, there would be pressure from inside the EU to fix it.

[ Parent | on HN ]

Re:Spammers are better at SPF, DKIM, and DMARC than everyone... by JumpCrisscross on Wednesday March 26, 2025 @07:50AM (#43481165)

They’re a small economy with lots of hostile traffic, so while in the EU and not sanctioned like the rest of the bunch, I’ve commonly seen them on the chopping block.

[ Parent | on HN ]

Re:Spammers are better at SPF, DKIM, and DMARC than everyone... by jamespo on Tuesday March 25, 2025 @10:18AM (#43471670)

A nice GH project for this: https://github.com/friendly-bits/geoip-shell?tab=readme-ov-f...

[ Parent | on HN ]

Re:Spammers are better at SPF, DKIM, and DMARC than everyone... by jillyboel on Tuesday March 25, 2025 @01:30PM (#43473772)

just close the tcp sockets and you wont even notice them trying to connect and failing

do you also log everyone who looks at your house? it's a self inflicted problem

[ Parent | on HN ]

Re:Spammers are better at SPF, DKIM, and DMARC than everyone... by fc417fc802 on Tuesday March 25, 2025 @04:38PM (#43475685)

At least in the case of VPS my experience has been 99% failed ssh attempts. I just use nftables to rate limit those to 2 failed attempts per minute. Log size is quite modest and can easily filter out failed attempts when viewing.

[ Parent | on HN ]