TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

DMARC Secured Email Identities but Broke Mailing Lists

82 pointsby samtodayover 8 years ago

16 comments

mileswuover 8 years ago
Forwarding email with outlook.com&#x2F;Office365&#x2F;Microsoft Exchange also breaks DMARC. Exchange Server sometimes modifies the headers of emails when forwarding them, invalidating the DKIM signature, so then a DMARC policy rejects the forwarded email. Apparently Microsoft have a fix in the pipeline for this, but it&#x27;s been taking ages.<p>More info at: <a href="https:&#x2F;&#x2F;blogs.msdn.microsoft.com&#x2F;tzink&#x2F;2016&#x2F;05&#x2F;19&#x2F;why-does-my-email-from-facebook-that-i-forward-from-my-outlook-com-account-get-rejected&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blogs.msdn.microsoft.com&#x2F;tzink&#x2F;2016&#x2F;05&#x2F;19&#x2F;why-does-m...</a>
tytsoover 8 years ago
The primary problem is that DMARC is fundamentally flawed, and was not enacted using a standards process that respected all of the stakeholders. As a result, it fundamentally becomes a matter of power politics.<p>If there are a bunch of people who need to participate in a particular mailing list --- say, IETF mailing list or the Linux Kernel development lists --- more than they need to stick with a particular mail provider, it becomes possible to say to them, &quot;you want to participate in our community&quot;? Change mail providers.<p>In the cases where a mailing list community badly needs the Yahoo users, Yahoo can dictate to the mailing list --- change your mailing list software and inflict pain all on your mailing list users, or you don&#x27;t get access to our e-mail user community. (And rewriting the from field has all sorts of bad effects, including corrupting contact databases that auto populate based on names and addresses in the from field, making the mail summary index useless, breaking reply-to sender, etc. So there is real pain involved here.)<p>Part of the issue was that DMARC was originally intended for domains that only sent official announcements (e.g. for credit card companies or banks) and where employee e-mails came from a different domain. For that original use case, DMARC worked perfectly well. Apparently Yahoo then decided it had a terrible SPAM problem, and decided DMARC was a blunt instrument to use, and inflicted on consumer e-mails. Other companies didn&#x27;t think ahead, and used the same domain for official e-mails as their employee e-mails, and decided that protecting their users was more important than inconveniencing their employees.<p>This is why it&#x27;s ultimately all about power politics. If you want to participate in Linux Kernel development, you need an e-mail address that won&#x27;t arbitrarily cause your e-mails to be dropped (for example, so Linus Torvalds doesn&#x27;t get your pull requests). Despite this, growth in Linux Kernel Development continues to be growing, which means that when choosing between the inconvenience of changing or using an alternate e-mail provider, versus participating in Linux development, developers choose the former. But that only work because Linux has the economic power and clout to get away with it.<p>Heck, over ten years ago, refusing to buckle in to crap e-mail systems forced IBM to allow its Linux Technology Center folks install a standards-complaint IMAP server instead of using that abomination caused Lotus Notes which the rest of the company was forced to use. (And this was probably a better demonstration of the power of Linux, given how much IBM was stubbornly attached to Blotus Goats.) But make no mistake. This is Trump style, power politics. It doesn&#x27;t hurt those with a lot of economic power, but if you&#x27;re some tiny, podunk church mailing list, or some other group lacking in economic power, you&#x27;re screwed.<p>DMARC: making email &quot;great&quot; again.
mpa000over 8 years ago
I stopped reading when it referred to SPF as &quot;Sender Protection Framework.&quot; As usual, the discussion on HN is far better than R&#x27;ing TFA.<p>We recently had a collision between the practices of one of our vendors, the silly way that .edu&#x27;s tend to forward mail, and Gmail&#x27;s DMARC policy. The vendor is doing everything &quot;right&quot; in terms of their own (completely transactional) mailings on our behalf but some still want to blame them for poorly forwarded messages sent to .edu addresses that subsequently get swallowed up by Gmail and are never seen by the authors or referees.
评论 #13427243 未加载
roketridahover 8 years ago
Authenticated Received Chain (ARC) is being developed to work simultaneously with DMARC and help provide relief to mail agents that break DKIM by allowing ARC aware receivers to sign authentication results that allow downstream processors to review what the initial results were and make their decisions.<p>Details at <a href="http:&#x2F;&#x2F;arc-spec.org&#x2F;" rel="nofollow">http:&#x2F;&#x2F;arc-spec.org&#x2F;</a>
mikegerwitzover 8 years ago
&gt; For many years, there was no real way to verify that you really got the email the person that the From header states.<p>DMARC doesn&#x27;t really assert your identity---it asserts the identity of the server.<p>Remember that you can also use PGP to assert _yourself_, and this works well with mailing lists (your mail client will hopefully distinguish between the signed message and the mailing list footer, which is unsigned). It also persists---if a mailing list is stripping DMARC headers, then that doesn&#x27;t help you any.
评论 #13426273 未加载
gcpover 8 years ago
So what did LKML end up doing?<p>Edit: given the Ts&#x27;o response above I guess they enforce the sender to not have DMARC.<p>&quot;There are people with google.com addresses that need to use non-Google addresses in order to participate on the Linux Kernel Mailing List.&quot;<p>See also: <a href="https:&#x2F;&#x2F;www.ietf.org&#x2F;mail-archive&#x2F;web&#x2F;dmarc&#x2F;current&#x2F;msg03236.html" rel="nofollow">https:&#x2F;&#x2F;www.ietf.org&#x2F;mail-archive&#x2F;web&#x2F;dmarc&#x2F;current&#x2F;msg03236...</a>
shuttonover 8 years ago
I work on Gaggle Mail which is a group mailing list provider that avoids all this by only using a From address that we control. I do think stricter addressing policies will become the norm in years to come which is why we took this approach.<p>More details here: <a href="https:&#x2F;&#x2F;gaggle.email&#x2F;how-emails-are-addressed-and-sent" rel="nofollow">https:&#x2F;&#x2F;gaggle.email&#x2F;how-emails-are-addressed-and-sent</a>
proaralystover 8 years ago
As someone who thought it&#x27;d be a good idea to run their own mail server, I found that without SPF&#x2F;DKIM&#x2F;DMARC your mail gets identified as spam a lot. Having DMARC just means you get told about it.
评论 #13426480 未加载
peterwallerover 8 years ago
SPF has another problem. I sent an email to someone recently @theirdomain.com. I subsequently saw by chance that the email was rejected because they were hosting @theirdomain.com with a random ISP but they had configured the mail to be forwarded to a mailbox in @gmail.com.<p>Gmail sees the email coming from @theirdomain.com&#x27;s servers, rather than my server. Gmail checks the SPF record which doesn&#x27;t match, and it rejects it.<p>I understand that this style of forwarding is anyway bad because gmail see&#x27;s all email the user receives @theirdomain.com as coming from those servers, not their true origin. If @theirdomain.com receives (and forwards) any spam, it looks like a spammer to gmail.
评论 #13427813 未加载
评论 #13426793 未加载
__david__over 8 years ago
If the mailing list changes the From address, then the message won&#x27;t show the correct author in the message list in my email client. Replying may work (because of Reply-To:), but not having the correct &quot;From&quot; in the client is really a deal breaker.<p>Besides, DKIM already solved this problem by not caring <i>where</i> the mail comes from, just that the message was signed. It seems the solution to me is to stop using SPF if you want to use mailing lists.
评论 #13426227 未加载
评论 #13426197 未加载
评论 #13426196 未加载
joecotover 8 years ago
Ran into this problem setting up a new mailing list system. I&#x27;d always wondered by mailing list mail sent from yahoo went directly to spam, while mail from gmail worked just fine.<p>Mailing list mail will always fail DMARC if you keep the original sender&#x27;s address, but when setting up DMARC for a domain, you specify what should happen to mail from your domain if it fails the DMARC check.<p>For gmail and other sane providers, their DMARC failure is set to ignore, which means DMARC failing for those addresses gets calculated into spam probability, but isn&#x27;t an auto-fail. For yahoo and AOL, they have it set to reject, which means mailing list mail from those domains automatically goes to spam for gmail.<p>Groupserver mailing list software resolves this by checking the DMARC settings for the sender. If DMARC is set to ignore, the sender address is kept, because it won&#x27;t actually affect delivery. If it&#x27;s set to reject, it mangles the sender address so that the mail at least gets delivered.
INTPenisover 8 years ago
I&#x27;ve had some contact with a big client e-mail filter, (30k+ users) and we chose to expose a soft SPF in the external DNS and a hard SPF in an internal DNS used as a cache by the mailfilter.<p>This was a workaround because the big org had countless 3rd party suppliers of services who many times wanted to mail as @big.corp. And this was fine when mailing to big corp as we could whitelist their senders in the SPF service config, but when mailing to the rest of the internet like gmail, yahoo and hotmail we needed a soft SPF fail instead of having to add those countless servers in our DNS record.
jedbrownover 8 years ago
Unfortunately, having the list software create a new message breaks threading. It is common practice to Cc people (subscribed to the list or not) that may need to interact with the thread, but they get the message directly from the sender while list recipients get a different message (different From, different Message-ID). Similarly, if the original sender replies to their own outgoing message, it will not thread for list recipients.
评论 #13427068 未加载
dekhnover 8 years ago
Once, I needed to email something to djb. I tried, and his email system sent back a challenge which was dumped into my spam box. I never did manage to get an email to him.
threshover 8 years ago
DMARC sucks.<p>Source: I run two big mailman installations.
评论 #13426423 未加载
zAy0LfpBZLC8mACover 8 years ago
This is a terrible article that&#x27;s almost completely wrong as it doesn&#x27;t even mention the distinction between envelope (SMTP) from and header (RFC822) from.<p>The envelope from is what is transmitted in SMTP commands and specifies where bounces due to delivery delays or failures are supposed to be sent, the header from is what is displayed to the recipient as the sender, but is completely ignored by SMTP.<p>SPF only deals with the envelope from, DKIM only deals with the header from (and other parts of the email headers&#x2F;content).<p>Really, there is nothing there that necessarily prevents mailing lists from working just fine:<p>A mailing list can (and should) replace the envelope from with its own address, so that bounces from subscribers aren&#x27;t sent to the author of the message, but to the mailing list software, which then can do bounce management, such as automatically unsubscribing addresses that consistently bounce because they don&#x27;t exist anymore. As the mailing list software should use its own domain for the bounce addresses, the mailing list operator can set up SPF to authorize the mailing list server as an outbound server for that domain just fine, and that has no effect whatsoever on the header from that&#x27;s shown to the recipient, and that replies would go to by default.<p>As for DKIM, you simply should not modify the message, and it will deliver just fine, whether through a mailing list or directly. Modifying the message mostly really shouldn&#x27;t be necessary. Reply-to mangling is a bad idea anyhow, and the mailing list should be recognized by the client software either because it&#x27;s in the destination headers, or by using mailing-list headers added by the mailing list software, instead of mangling the body or the subject.
评论 #13426440 未加载
评论 #13427046 未加载
评论 #13426558 未加载
评论 #13426789 未加载