Create accountLogin

Recent searches

No recent searches

Search options

Only available when logged in.
techhub.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
A hub primarily for passionate technologists, but everyone is welcome

Administered by:

Server stats:

5.3K
active users

techhub.social: AboutStatusProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.3.7

#whatever

2 posts2 participants1 post today
Replied in thread
Public *
Erik van Straten

@grumpybozo : I definitely am not angry with you (I very much agree).

Unfortunately many admins treat security solutions like they're a religion.

Some time age there was a hefty debate on a Dutch "mostly admins" site (tweakers.net, I'd have to look up the exact thread) about the "correct" sending and receiving MTA configurations. There was no agreement.

Microsoft even used to ignore SPF/DKIM/DMARC if the sender was in the "safe senders" list (which the user's address book defaults to). What could possibly go wrong (later MS corrected that).

The screenshot below is from part of security.nl/posting/766069/DMA (I wrote that Sept. 14, 2022).

Edited 23:36 UTC to add: {
arxiv.org/abs/2302.07287
Forward Pass: On the Security Implications of Email Forwarding Mechanism and Policy
Enze Liu, Gautam Akiwate, Mattijs Jonker, Ariana Mirian, Grant Ho, Geoffrey M. Voelker, Stefan Savage
}

Screenshot from part of https://www.security.nl/posting/766069/DMARC+bypass+%28Outlook+only%3F%29#posting767981 Microsoft has meanwhile changed this behavior, but https://docs.microsoft.com/en-gb/microsoft-365/security/office-365-security/use-dmarc-to-validate-email#how-microsoft-365-handles-inbound-email-that-fails-dmarc used to read: { How Microsoft 365 handles inbound email that fails DMARC If the DMARC policy of the sending server is p=reject, Exchange Online Protection (EOP) marks the message as spoof instead of rejecting it. In other words, for inbound email, Microsoft 365 treats p=reject and p=quarantine the same way. [...] Microsoft 365 is configured like this because some legitimate email may fail DMARC. For example, a message might fail DMARC if it's sent to a mailing list that then relays the message to all list participants. If Microsoft 365 rejected these messages, people could lose legitimate email and have no way to retrieve it. Instead, these messages will still fail DMARC but they'll be marked as spam and not rejected. If desired, users can still get these messages in their inbox through these methods: • Users add safe senders individually by using their email client. [...] }
#SPF#DKIM#DMARC
Replied in thread
Public
Erik van Straten

@deepthoughts10 wrote: "email authentication like DMARC/SPF does one thing: it prevents impersonation of a specific domain (assuming policies are configured for reject or quarantine.)"

It does not even do that on my iPhone.

P.S. SPF was invented to prevent Joe Jobs (en.wikipedia.org/wiki/Joe_job). Marketing idiots (including Bill Gates) said that it would kill spam. It killed forwarding instead.

@grumpybozo @jwz

Screenshot showing an email sent by "Liberapay Support" regarding problems with a payment for infosec.exchange. Problem: the sender domain is not shown.
#SPF#DKIM#DMARC
ExploreLive feeds
About