Thread

Loading the complete thread in the background. This saved snapshot is available now. Refresh

1. comrade1234 · 1790880106 · focus · HN ↗

   You also need to set up reverse dns to avoid ending up in spam folders at the big ones.
2. adiabatichottub · 1790880364 · focus · HN ↗

   I recently tried bouncing mail during the header phase when DMARC didn't align, but it rejected more legit emails than SPAM. Most of the junk we've been getting passes DMARC and has an unsubscribe link.

   1. marcus9999 · 1790884376 · focus · HN ↗

      [dead]

   2. thayne · 1790885274 · focus · HN ↗

      DMARC doesn't really do much to prevent general spam. It prevents spoofing the from address, which provides some protection against phishing, but if the email is from the domain it claims to be, it can pass DMARC whether or not it is spam.

      1. adiabatichottub · 1790886394 · focus · HN ↗

         Indeed. Ultimately we're still relying on blacklists, Bayesian filters, and hueristics to detect actual SPAM.
   3. edelbitter · 1790886912 · focus · HN ↗

      [delayed]

      1. adiabatichottub · 1790888039 · focus · HN ↗

         I'll have to ponder the method you describe. I know I could implement that on my own mailboxes and some automated endpoints, but not sure how that would work for other users on our domain.

         1. edelbitter · 1790891163 · focus · HN ↗

            [delayed]
   4. 2000UltraDeluxe · 1791007624 · focus · HN ↗

      DMARC is for authenticating the sender, not filtering spam.
3. zh3 · 1790880706 · focus · HN ↗

   I did exactly this today.

   Fire up Claude, give it an account with sudo, let it loose. Not long after, emails from $PERSONALDOMAIN are making it through to my gmail and outlook accounts.

4. buredoranna · 1790880710 · focus · HN ↗

   This looks like a pretty good resource.

   I'd like to add the following, which I continually reference and has led to repeatable success:

   <a href="https:&#x2F;&#x2F;www.linuxbabe.com&#x2F;mail-server&#x2F;setting-up-dkim-and-spf" rel="nofollow">https:&#x2F;&#x2F;www.linuxbabe.com&#x2F;mail-server&#x2F;setting-up-dkim-and-sp...

   And as far as confirming it works, I continually rely on sending to a gmail address. Under the three dots is &quot;view original&quot; which gives you

   SPF, DKIM, and DMARC results;

5. jcul · 1790882991 · focus · HN ↗

   This is a cool site to visualise your SPF, DKIM, DMARC setup interactively.

   <a href="https:&#x2F;&#x2F;www.learndmarc.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.learndmarc.com&#x2F;

   1. dbbr · 1790886664 · focus · HN ↗

      +1. I used this to set up DMARC and ended up signing up for their service. Only like ~$12&#x2F;year and works.
6. duhhhhh1212 · 1790885313 · focus · HN ↗

   <a href="https:&#x2F;&#x2F;www.pangram.com&#x2F;history&#x2F;8c0a7f5f-3db7-4435-b459-04ae31203c80?ucc=t8c6BkzVOh8" rel="nofollow">https:&#x2F;&#x2F;www.pangram.com&#x2F;history&#x2F;8c0a7f5f-3db7-4435-b459-04ae...

   Don’t waste your time.

   1. dolebirchwood · 1790886780 · focus · HN ↗

      Is the information actually wrong, misleading, or otherwise deficient?

      1. duhhhhh1212 · 1790887431 · focus · HN ↗

         Idk but I’m not wasting my time checking all that. Feel free to give us a detailed line by line analysis of what’s misleading&#x2F;deficient.

         The reason for my post was that you the reader is most likely gonna spend more time reading this post than the author(s) did writing it.

         1. glitchcrab · 1790887980 · focus · HN ↗

            Thanks for the heads up, looks like this is a case of AI;DR (maybe I should get some bumper stickers printed).

            1. gerdesj · 1790888244 · focus · HN ↗

               It clearly is AI generated but the ideas as presented are mostly sound.

               However, it is woefully incomplete.

7. jonathanlydall · 1790885339 · focus · HN ↗

   We generally run on Microsoft 365 and use SendGrid for transactional emails such as password resets.

   We have the CNAME set up for a like em1234 sub-domain as per SendGrid’s docs which their docs say should cover SPF even if the emails we send have a from address of our main domain (eg noreply@example.com), this is apparently because receiving servers are supposed to do SPF checks against the replyTo address which sendgrid does populate with an address on the subdomain.

   This has worked fine for years, Gmail for example is happy and looking at mails from us says everything passes.

   However, we recently onboarded a large corporate whose server was blocking the SendGrid emails because it was checking the SPF against the from header rather than the replyTo.

   Only way to let the email through was to either add SendGrid SPF records to our main domain, or change the from address of the SendGrid emails, neither of which was 100% ideal.

   Not going to try tell the client they’ve configured their server wrong, but have they?

   1. mcmcmc · 1790885883 · focus · HN ↗

      No, they haven’t. With your current config sounds like you are failing SPF alignment. Is your SPF record in strict mode? Do you have DMARC set up and are you DKIM signing the SendGrid emails from your domain?
   2. adiabatichottub · 1790888458 · focus · HN ↗

      SPF doesn&#x27;t check the reply-to address, only that the host sending the mail is allowed to send mail for the domain in the MAIL FROM: header.

      See: <a href="http:&#x2F;&#x2F;www.open-spf.org&#x2F;FAQ&#x2F;What_it_does&#x2F;" rel="nofollow">http:&#x2F;&#x2F;www.open-spf.org&#x2F;FAQ&#x2F;What_it_does&#x2F;

      Edit: for those unfamiliar with the intricacies of SMTP, the first three lines sent are HELO, MAIL FROM:, and RCPT TO:. The From: address that you see in your mail client is actually another header that gets sent once the server provisionally accepts the message based on the first three headers. It&#x27;s the difference between the return address on the envelope of a paper letter, and an address printed on the letterhead of the actual letter.

   3. mnaza · 1790924959 · focus · HN ↗

      [dead]

8. gerdesj · 1790887822 · focus · HN ↗

   This was not written by an email admin. Start with the real basics:

   Your MTA should announce itself and DNS should agree. So your MTA says: HELO smtp.example.co.uk

   smtp.example.co.uk will resolve to an A record (say a.b.c.d) and a reverse lookup will also work:

   d.c.b.a.in-addr.arpa PTR smtp.example.co.uk.

   Remember this is all about reputation, so if you also DNSSEC sign example.co.uk, then you will look like you care about your domain reputation.

   Then do SPF, DKIM and DMARC. Note how the example for SPF stops at ~all and not -all. The rest is also superficial.

   Anyway, I run email systems that do the job properly and it is not trivial and certainly not formulaic. There is no shortcut to getting an IP address&#x2F;range trusted.

   The advice on that page is ... good as far as it goes but woefully inadequate for running an email system. It&#x27;s a good start.

   1. albertgoeswoof · 1790887979 · focus · HN ↗

      They don’t do ips they just use SES, same as resend and a bunch of other email startups lately

      1. gerdesj · 1790888098 · focus · HN ↗

         Sorry, what is SES?

         1. dddw · 1790888701 · focus · HN ↗

            Simple Email Service, by AWS. Mainly tramsactional email, but noy exclusively
         2. taylortrusty · 1790889471 · focus · HN ↗

            Wait, you claim to run email systems and don&#x27;t know what SES is?

            1. wahern · 1790905428 · focus · HN ↗

               If you hosted your own email server, why would you need to be familiar with SES, especially if you&#x27;ve been hosting longer than SES providers have been around?

               Like email, I run my own HTTP server, serving directly to clients. I know about Cloudflare just from HN threads, but have never used it or know much about that whole reverse proxy universe beyond the very low-level details from having written several reverse proxies myself.

            2. adrian_b · 1790933280 · focus · HN ↗

               Precisely those who run their own email systems have no need to know what SES is.
            3. Anthony-G · 1790952807 · focus · HN ↗

               Why would they? I’ve been running Internet servers (web, DNS, SMTP, IMAP, database) for about 25 years and until recently have only had the roughest idea of what EC2 or an S3 buckets are. It’s only because my employer recently started working with a new company that uses AWS that I’d have heard of SES. Also, I’ve no idea what the Azure equivalents are. If I ever need to know, I’ll find out but until then, ignorance is bliss.
            4. gerdesj · 1790987830 · focus · HN ↗

               Well, please tell me what SES is - no need to be a tease.

               I just run Exim and Postfix instances that shuffle email around the world. I also have several Dovecots that store the stuff and a large number of MS Exchange online tenants.

   2. adiabatichottub · 1790888922 · focus · HN ↗

      I think a better resource is <a href="http:&#x2F;&#x2F;www.open-spf.org&#x2F;" rel="nofollow">http:&#x2F;&#x2F;www.open-spf.org&#x2F;
   3. snowwrestler · 1790910615 · focus · HN ↗

      I’ve never seen evidence that DNSSEC helps email reputation. Always willing to consider new evidence though.

      Reputation, in my experience, is not really based on tech stuff. You can ruin it with bad technical configuration, sure. But the only way to grow it above average is to send a steady stream of emails that readers open and click, sustained over a period of time, with no complaints.

9. albertgoeswoof · 1790887939 · focus · HN ↗

   This is an aws ses wrapper so is basically irrelevant in the email world

Unofficial Hacker News client; not affiliated with Y Combinator.