SoylentNews is people
SoylentNews
from the mail-only-accepted-from-ourselves dept.
On his blog, Peter N. M. Hansteen sometimes writes about the problems with getting certain mail service providers to up their game. This time his post provides the details on how a particularly large service not only fails at SMTP sender verification but also at many other tasks necessary for professional mail hosting.
Whenever I encounter incredibly stupid and functionally destructive configuration errors like this I tend to believe they're down to simple incompetence and not malice.
But this one has me wondering. If you essentially require incoming mail to include the contents of spf.outlook.com (currently no less than 81 subnets) as valid senders for the domain, you are essentially saying that only outlook.com customers are allowed to communicate.
If that restriction is a result of a deliberate choice rather than a simple configuration error, the problem moves out of the technical sphere and could conceivably become a legal matter, depending on what outlook.com have specified in their contracts that they are selling to their customers.
One takeaway is that spam-fighting decisions from decades past have left us with technologies that have led to the centralization of mail on fewer and fewer providers. As such it is increasingly difficult for even skilled professionals to operate their own mail hosting smoothly.
Source : A Life Lesson in Mishandling SMTP Sender Verification
(Score: 3, Interesting) by nobu_the_bard on Monday February 19 2018, @01:33PM (1 child)
Most of the big mail providers won't block mails that fail only SPF. I suspect they just score on it.
There's probably two reasons for it:
1. Many, many people have incorrectly written SPF records.
2. Many of the largest mail providers can get by on nearly just content scanning; providers like Gmail have MASSIVE amounts of information about spam from having enough users that actually report feedback due to their scale, making content scanning a lot easier than for smaller providers.
(Score: 0) by Anonymous Coward on Tuesday February 20 2018, @01:18AM
1. You got that right. I cannot tell you how many domains I have looked at after onboarding a customer only to find wrong SPF settings and it is disturbingly common to find multiple SPF records. One customer even had 5!
2. I support tons of Office 365 and most customers just have the basic SPF record set even though MS did most of the heavy lifting to set up DKIM with a DMARC policy. I had one customer with no SPF record, no DKIM, no DMARC, nothing. I was astounded that people received anything they sent. There are so many hokey mail setups it is no wonder spam is such a problem.
I think a big part of the problem is that, when an email gets blocked, the users blame their email admin. They do not know or care that the sender may have completely wrong SPF or DMARC or nothing at all; all they know is that somebody tried to email them and "you" are blocking them from getting the email. So, naturally, email admins have to do things like not block on SPF failure, not block on DKIM failure, accept email from domains with no records, and all sorts of other terrible things. So, we end up content filters that are basically magic boxes. We end up with the lowest common denominator.