Hacker News new | past | comments | ask | show | jobs | submit
ranger_danger | on: Outlook.com is rejecting email from domains without DMARC
Is there any actual evidence of this outside of this one company's AI-generated article?
jared_stewart | parent | next
There's been ample evidence of this, many different blogs, notification emails etc.

This thread duplicates the first observations of this which showed up here yesterday at https://news.ycombinator.com/item?id=50404161

My mail provider, MXroute, sent me a notification of the issue early yesterday. There is commentary from various DMARC providers (Suped and PowerDMARC). This is a real thing.

It does not matter which host you are using, this has nothing to do with the hosting provider. It has everything to do with having your domain correctly set up on DNS so that anybody receiving mail will know how to authenticate it. Microsoft has apparently advanced a policy that if you don't even try you don't get to send.

IMO this is the right call, I've seen plenty of spoofing attacks where the attacker took advantage of nonexistent policy on non-sending domains. You might think that if you don't have an MX record the domain can't be used to send mail, that is wrong. The MX record only tells others where to send your mail, it says nothing about whether the domain can send mail itself.

majorchord | root | parent
Ample evidence that the policy now extends to low-volume senders? Could you provide even one example?
loading story #50421981
Tomte | parent
I got a bounce on a mail from my personal Fastmail account (with my own domain) the day before yesterday.

I had SPF/DKIM set up, just not DMARC. Did that yesterday and don‘t see the point. My policy is "none".

jared_stewart | root | parent
The point is to have a DMARC record, setting it to none doesn't really do much of anything for you though. If you really wanted to take advantage of it you will need a DMARC monitoring solution - the market seems to typically price these around $10/month for small-ish domains (though there are a lot of caveats). I'm trying to build a reasonable free option that maybe isn't enough to get a domain to a reject policy, but should be enough for you to maintain a reject policy.

The truth is that there are amply "non-sending" domains out there which ignore DMARC and allow abuse. Stopping the assumption of no policy mean p=none prevents this abuse from persisting.

cowlevel | root | parent
How does having a record with no policy make the internet safer?
ranger_danger | root | parent
How does making driving license exams harder make the roads safer?