SoylentNews

SMTP Sender Verification - Incompetence is Sometimes Indistinguishable from Malice

posted by Fnord666 on Monday February 19 2018, @05:54AM   
from the mail-only-accepted-from-ourselves dept.

canopic jug writes:

On his blog, Peter N. M. Hansteen sometimes writes about the problems with getting certain mail service providers to up their game. This time his post provides the details on how a particularly large service not only fails at SMTP sender verification but also at many other tasks necessary for professional mail hosting.

Whenever I encounter incredibly stupid and functionally destructive configuration errors like this I tend to believe they're down to simple incompetence and not malice.

But this one has me wondering. If you essentially require incoming mail to include the contents of spf.outlook.com (currently no less than 81 subnets) as valid senders for the domain, you are essentially saying that only outlook.com customers are allowed to communicate.

If that restriction is a result of a deliberate choice rather than a simple configuration error, the problem moves out of the technical sphere and could conceivably become a legal matter, depending on what outlook.com have specified in their contracts that they are selling to their customers.

One takeaway is that spam-fighting decisions from decades past have left us with technologies that have led to the centralization of mail on fewer and fewer providers. As such it is increasingly difficult for even skilled professionals to operate their own mail hosting smoothly.

Source : A Life Lesson in Mishandling SMTP Sender Verification

---

Original Submission

• Re:Delicious irony of spam (Score: 4, Informative) by c0lo on Monday February 19 2018, @10:40AM

  by c0lo (156) on Monday February 19 2018, @10:40AM (#640045) Journal

  The first post by the AC implicitly laid blame at Microsoft's door for spam and the absurd tools used to fight it.

  Have you RTFA? It's not the "absurd tools" it is the "absurd configuration of the tools" the story is about. TFS quote:

  Whenever I encounter incredibly stupid and functionally destructive configuration errors like this I tend to believe they're down to simple incompetence and not malice.

  The abusrd configuration:
  - allows spam be send outside outlook.com
  - does not allow abuses to be reported if using an email address outside outlook.com

  The result of that absurd configuration?
  1. outlook.com starts to be intensively used as a source for spam...
  2. ... all the while, I assume, Microsoft does the needed to keep the outlook.com mailboxes free of spam.

  If that's not incompetence, the only interpretation is "Microsoft plays the long extortion game of letting spam go outside and protecting their consumers inside".
  Which, I suppose is a possible interpretation of:

  If you were into conspiracy theories, you could even think M$ was playing the long game here. And this current behavior is no less than one would expect from a convicted monopolist.

  Yes, I admit, the AC may be right for the wrong reason; I do find the "vulnerable windoze boxes that lead to the whole spam issue and the mostly retarded methods to fight it." a bit of a... (mmm, to use some pretentiously exaggerated terminology...) poetic hyperbole.

  --
  https://www.youtube.com/watch?v=aoFiw2jMy-0 https://soylentnews.org/~MichaelDavidCrawford

  Parent

  Starting Score:	1		point
  Moderation		+2
  Informative=2, Total=2
  Extra 'Informative' Modifier		0
  Karma-Bonus Modifier		+1
  Total Score:		4