Post #1884808
2024-12-15 13:34 UTC
Replies (29)
-
@Aganim@lemmy.world 2024-12-15 13:46
DMARC record that tells the receiving email server how to handle email that fails either check. Could be that I misunderstood you, but: It tells what to do if no mechanism (DKIM or SPF) results in a pass. DMARC actually only requires one mechanism to pass. So an email with a DKIM fail, but an SPF pass is considered OK. And vice-versa. Edit: good advice by the way regarding protecting your domain reputation, I’ll check our non-email domains at work first thing tomorrow.
-
@themoonisacheese@sh.itjust.works 2024-12-15 14:17
This is overall best practices and overall correct (as in: you should probably do this, and it will never hurt), but realistically any domain that doesn’t at least have an SPF record will be already treated as unable to send mail at all by any properly configured receiving server, especially ones that would report you to a blocklist. This isn’t bad advice regardless, just a bit redundant.
-
@pasmac@atmasto.com 2024-12-15 14:50
@Jerry arghh forgot to up date the IP address …. 🤬 Good tip
-
@tychotithonus@infosec.exchange 2024-12-15 15:38
@Jerry No-email [inbound] domains should also set a "null MX", per RFC7505: https://www.rfc-editor.org/rfc/rfc7505.html MX 0 "."
-
@dotslashme@infosec.pub 2024-12-15 15:44
Very good tip! Thank you.
-
@simrob@social.wub.site 2024-12-15 15:46
@Jerry thanks for sharing this. It was boosted into my neck of the woods and I don’t actually know who you are - is there a semi-authoritative place this advice is documented that I can 1) double check, because that seems like a good idea at least in principle with security related stuff like this and 2) pass on to others?
-
@cosmicspittle@ecoevo.social 2024-12-15 15:47
@Jerry Thank you for this
-
@pteryx@dice.camp 2024-12-15 16:01
@Jerry Last I knew, my roommate who ran a homebrew server was frustrated that they *can't* run an email server because outgoing email was assumed to be spam anyway. It would be nice if there were an actual way out of this!
-
@krelvar@lemmy.world 2024-12-15 16:09
There is nothing admin-wise I hate more than dealing with email security. Fucking google is horrible. At least when Microsoft randomly decides the half dozen family members on my personal domain are bulk email spammers, there’s a form to reach out. Google is a piece of shit in this way just like in so many other ways.
-
@antondollmaier@mastodon.social 2024-12-15 16:34
@Jerry thanks for the advice! Shouldn't the dmarc record be added, differently to SPF, to the subdomain of "_dmarc"?
-
@amyipdev@transfem.social 2024-12-15 16:38
@Jerry@hear-me.social I've never been able to get SPF or DKIM to work properly, honestly. The DKIM information just never sends (using Postfix) and SPF checks don't pass anymore, no clue why. I just gave up at some point.
-
@bogdanbiv@mastodon.social 2024-12-15 16:42
@Jerry I needed to hear this
-
@me@mastodon.cysioland.pl 2024-12-15 16:56
@Jerry sometimes I'm getting tons of mail.ru DMARC reports saying that someone has tried to send shittones of mail from my domain but SPF+DKIM stopped them
-
@fennix@infosec.space 2024-12-15 18:01
@kkarhan @Jerry have domains that predate SPF, requirements unclear. :p
-
@fennix@infosec.space 2024-12-15 19:12
@kkarhan @Jerry I'm aware, was mostly sarcasm about how no security was baked in in the first place. These solutions are all hacked onto systems that themselves are unreliable and require additional security features to begin to trust. Turtles all the way down, if you will.
-
@shauvikkumar@mastodon.social 2024-12-15 18:30
@Jerry helpful
-
@Xitnelat@wue.social 2024-12-15 18:41
There's an article at gov.uk also covering DKIM and null-records: https://www.gov.uk/guidance/protect-domains-that-dont-send-email @Jerry
-
@Char@noc.social 2024-12-15 18:58
@Jerry #email If it helps anyone as an example of a domain w/o email, I have a domain 'hack-char.dev' that has those records configured. Never knew about the null mx, and will put one in today. As a side note, I've seen someone try to spoof a different domain of mine and for some reason gmail sends a bounce to my domain, without rua set. I was wondering if it was an attempt to get a phish through in a bounce, but I don't see how that would be successful.
-
@RobynNuthall@mastodon.nz 2024-12-15 19:05
@Jerry Thank you!!!
-
@sgsax@mastodon.social 2024-12-15 19:16
@Jerry Saving this for later. I do run email from my personal domain, but adding spf for a little extra insurance is a good idea.
-
@freddieleeman@infosec.exchange 2024-12-15 19:36
@Jerry The M3AAWG provides best practices for parked domains, including the recommendation to implement a wildcard DKIM record. *._domainkey.example.com TXT “v=DKIM1; p=” https://www.m3aawg.org/sites/default/files/m3aawg_parked_domains_bp-2015-12.pdf
-
@girlbandgeek@mastodon.social 2024-12-15 20:01
@Jerry Thanks for posting this. I never think about this, but I do have several domains and I need to make sure I have the proper DNS records for the new email security stuff. (I date from the days when all you had to worry about were MX records, but I realize we've moved on from that.)
-
@leoncowle@hachyderm.io 2024-12-15 20:36
@Jerry Great post, as a reminder! I work on this at work, but haven't paid the same attention to my own personal domains. And just a slight FYI, the SPF TXT record does indeed need to be on the apex/root domain, which, yes, some DNS providers use “@“ as a placeholder for, but that's not what “it is called”. Others, like AWS Route53, don't use that nomenclature. R53 writes out the apex/base domain, e.g. “example.com”, to indicate the apex/root domain.
-
@esplovago@mastodon.uno 2024-12-15 21:09
@Jerry great advice. One question: does this config protect also subdomains?
-
@ferricoxide@evil.social 2024-12-15 21:14
@Jerry@hear-me.social My domain is older than Google and has had SPF, DKIM and DMARC since each was just exiting proposal stages, yet Google and O365 each see fit to block mail from my MTA (yet I regularly receive spam from each): the 900lb gorillas don't actually care about spam; more that they want everyone to stop self-hosting.
-
@jzakotnik@mastodon.social 2024-12-15 21:49
@Jerry wow thanks, this is useful
-
@momo@mk.absturztau.be 2024-12-15 22:17
@Jerry@hear-me.social There’s also a null MX record for the sake of completeness https://serverfault.com/questions/714052/why-is-rfc-7505-null-mx-necessary
-
@b3lt3r@mastodon.b3lt3r.com 2024-12-15 22:28
@Jerry@hear-me.social would adding those txt records cause any issue to a wildcard redirect I use for myself? I have xxxxx.com and an auto redirect by my dns provider so that anything sent to name@xxxxx.com is forwarded to name@gmail.com so when I give out the address I can see if it's been shared. I like the idea of protecting against unauthorized use but wouldn't want to lose my throwaway capability. I find email servers to be akin to dark arts so am at a loss here tbh.
-
@mirabilos@toot.mirbsd.org 2024-12-15 22:48
@Jerry@hear-me.social is @ even legal in DNS? (It is not in hostnames, but so is _, so…)