Hacker News new | past | comments | ask | show | jobs | submit
0c3ca83 | on: Outlook.com is rejecting email from domains without DMARC
And what should a provider do if the dmarc policy says that none of the dkim or dmarc records should matter? What was the point of spf saying what servers could send, or dkim specifying signing keys?

"Oh, please, don't ignore the other two ways I told you to ignore unauthorized messages" shouldn't need a knob.

basilikum | parent
You are a mail server.

You get an email without a DKIM signature from me.

Is that because I do not use DKIM and do not sign my emails or because the message is forged and not from me at all?

You cannot tell. There is a single SPF record that you can look up to see if SPF is configured. It's just a TXT record on the domain. But there is no standard DKIM record. A DKIM signed email tells you what key identifier it used and you have to use that to look up the DKIM key at <key identifier>._domainkey.<sender domain>. When the email has no DKIM signature you cannot tell if that's because the sender domain does not use DKIM or if it does have a DKIM key record but it was not used, potentially because the email is forged.

0c3ca83 | root | parent | next
Right. And if you mandate dkim, as seems to be the case with servers that demand dmarc, what's the issue? You reject the emails where dkim isn't set.

Or do you think it's critical to support mail that doesn't have dkim?

basilikum | root | parent
You'll have a bad time if you just drop all emails without DKIM. There are many large senders that do not care about well established email standards and you will drop important emails.
0c3ca83 | root | parent
These are the same senders that are correctly configuring DMARC?
basilikum | root | parent
You said DMARC does not prevent email forgery. I simply corrected you on that and explained what DMARC does.

Setting a DMARC policy that allows unsigned emails is easier than configuring DMARC signing including key management. It's just adding a DNS record. Although large senders should of course do DKIM and it's not that hard either

But I'm not arguing with you about whatever Outlook did.

| root | parent
{"deleted":true,"id":50418554,"parent":50418243,"time":1794179204,"type":"comment"}