Important reminder, if you own a domain name and don’t use it for sending email.
There is nothing to stop scammers from sending email claiming to be coming from your domain. And the older it gets, the more valuable it is for spoofing. It could eventually damage your domain’s reputation and maybe get it blacklisted, unless you take the steps to notify email servers that any email received claiming to come from your domain should be trashed.
Just add these two TXT records to the DNS for your domain:
TXT v=spf1 -all
TXT v=DMARC1; p=reject;
The first says there is not a single SMTP server on earth authorized to send email on behalf of your domain. The second says that any email that says otherwise should be trashed.
If you do use your domain for sending email, be sure to add 3 records:
SPF record to indicate which SMTP server(s) are allowed to send your email.
DKIM records to add a digital signature to emails, allowing the receiving server to verify the sender and ensure message integrity.
DMARC record that tells the receiving email server how to handle email that fails either check.
You cannot stop scammers from sending email claiming to be from your domain, any more than you can prevent people from using your home address as a return address on a mailed letter. But, you can protect both your domain and intended scam victims by adding appropriate DNS records.
UPDATE: The spf and the dmarc records need to be appropriately named. The spf record should be named “@”, and the dmarc record name should be “_dmarc”.
Here’s what I have for one domain.
One difference that I have is that I’m requesting that email providers email me a weekly aggregated report when they encounter a spoof. gmail and Microsoft send them, but most providers won’t, but since most email goes to Gmail, it’s enlightening when they come.
#cybersecurity #email #DomainSpoofing #EmailSecurity #phishing
Yeah I regularly get DMARC reports for domains I’m not using. For ease I just added them as an alias to an Google workspace account I already have and use the DKIM, DMARC etc that Google provides. In case I ever need to send an email with that domain
@Jerry@hear-me.social
@yunohost@toot.aquilenet.fr I think it is ok:
https://doc.yunohost.org/fr/dns_configBut in case of ⬆️
@Jerry@hear-me.social thank you sir
This is overall best practices and overall correct (as in: you should probably do this, and it will never hurt), but realistically any domain that doesn’t at least have an SPF record will be already treated as unable to send mail at all by any properly configured receiving server, especially ones that would report you to a blocklist.
This isn’t bad advice regardless, just a bit redundant.
DMARC record that tells the receiving email server how to handle email that fails either check.
Could be that I misunderstood you, but: It tells what to do if no mechanism (DKIM or SPF) results in a pass. DMARC actually only requires one mechanism to pass. So an email with a DKIM fail, but an SPF pass is considered OK. And vice-versa.
Edit: good advice by the way regarding protecting your domain reputation, I’ll check our non-email domains at work first thing tomorrow.
@Aganim@lemmy.world
I’m not an expert on this (it’s a career), but I know it’s not that simple.If I get an unforwarded email, I definitely want both DKIM and SPF to pass. I want only email from an authorized server, and I want an email that is not modified and is properly signed. No exceptions. Both must pass.
If I get email from a mailing list that is sending email to me on behalf of a different domain, I want SPF to pass in that I want to know that the mailing list provider’s server is authorized to send email on behalf of the original domain. But, in this case, the original DKIM will fail because the mailing list provider will have changed the email. But, I expect the new DKIM to be correct, or I won’t accept it. So, here, a failure on the original DKIM can be acceptable.
If someone forwards an email to me, the original DKIM will fail. I will accept it. But, I want the SPF of the forwarding server to pass, and the new DKIM for the changed email to pass.
There’s also email redirection and forwards that happen at the server vs. the client and there can be separate rules for this.
The records can get complicated if you truly want to control different scenarios.
But, you don’t always want to accept an email if only 1 check passes.
At least, this is my understading of it all.
You are of course free to do with email what you want if you run your own email server. It’s simply that the DMARC RFC states that only one mechanism has to pass, so if you rely on your server’s DMARC implementation you won’t get what you want.
Edit: reworded a bit, I made it sound as if only one pass is allowed by DMARC.
There is nothing admin-wise I hate more than dealing with email security. Fucking google is horrible. At least when Microsoft randomly decides the half dozen family members on my personal domain are bulk email spammers, there’s a form to reach out. Google is a piece of shit in this way just like in so many other ways.
Google is much better. They send much less legitimate email to spam than Outlook & Hotmail. They also do have a bulk sender form. https://support.google.com/mail/contact/gmail_bulk_sender_escalation
As well as a “send feedback” option on most pages.
I’ll try that link next time they cut off my email for no reason, thanks.
@Jerry@hear-me.social
While you are securing your domain, 3 more good ideas:
-
Enable DNSSEC. This will sign the dns query responses to help ensure your DKIM and TLSA can be trusted.
-
Configure CAA records with only your TLS certificate issuer so any other certificates are not trusted.
-
Configure DANE TLSA records with a hash of the public keys for your email server and websites. Also be sure to configure the “mta-sts.@“ subdomain to serve the correct text file. This will provide an additional chain of trust for your email server (and websites server).
@Ruaphoc@mstdn.games
Thanks for this! This is on my list to look at this weekend. Thank you!
-
@Jerry@hear-me.social Personally, i also add this as a wildcard for the domain. Not sure if its really required, but better safe than sorry. Due to a standardized function i built for myself in my #dnscontrol files, its no additional work.
@Jerry@hear-me.social Nitpick: SPF record is not named “@”, it just needs to be at apex of zone. @ is often a shorthand to say apex in zonefiles, but doesn’t exist as such really in DNS queries and answers. Also, if you want to fully protect your domain, you can have a null MX record (RFC 7505) and for other matters than email, but also still important, a null CAA record to prevent any rogue certificates issued for it.
@Jerry@hear-me.social @nopatience@swecyb.com This is a gold nugget of a tip. Partly because it’s timeless. One of us should build a directory page full of #infosectips
@Jerry@hear-me.social No-email domains can also set a null MX:
https://www.rfc-editor.org/rfc/rfc7505.html
MX 10 “.”
@Jerry@hear-me.social Thank you for this
@Jerry@hear-me.social Last I knew, my roommate who ran a homebrew server was frustrated that they can’t run an email server because outgoing email was assumed to be spam anyway. It would be nice if there were an actual way out of this!
Anything from a residential IP is going to be marked as spam.
There is an actual way out of this, and it’s through a reverse tunnel.
@pteryx@dice.camp I set up my own email server on DigitalOcean and instantly got blacklisted by Spamhaus because it was a new domain, and then by another company because the IP address belonged to DigitalOcean.
Most mail servers also flagged it as spam because the domain was less than 60 days old and because it was a .online TLD. For a long time, some of my emails were immediately bounced back or went to spam folders because of all these reasons.
I also believe that every home IP address is automatically blacklisted, which makes it worse for your roommate.
You can eventually overcome it by letting the domain reputation slowly develop and then doing a direct appeal to the blacklist companies. But, it takes a long time.
It’s amazing any spam gets delivered.
Some of that isn’t quite the case. I run an email server quite successfully on a residential IP, with no valid PTR. And I’ve added recent domains without getting them blocked.
I’m not sure if the age of my primary domain (20ish?) might translate to google etc trusting any other domains from the same IP and DKIM key perhaps. But I’ve literally never had to dispute a block, ever. From all the horror stories I read, apparently I’m a unicorn.
@Jerry@hear-me.social @pteryx@dice.camp
Some IP from DigitalOcean, or OVH make sometimes that the whole AS is considered suspicious.
I remember when I had a dedicated server at OVH, I needed many time to gain reputation. Also, may be the previous user for the IP trashed the reputation.
I also remember later, with a server at other place that I needed to ban the AS for several weeks to prevent flooding in log by trivial attacks.
Create good reputation need time. And, sometimes you need fill form (for Microsoft) with IP.@Jerry@hear-me.social @pteryx@dice.camp Facebook bans my Selfhosted Server, frustrating.
@Dero_10@mastodon.sdf.org @pteryx@dice.camp
I had that issue a lot when I was running a Linux server in the cloud. It’s why I stopped using my own Wireguard VPN server I hosted on Digital Ocean. So many sites would block it.
@pteryx@dice.camp @Jerry@hear-me.social there isn’t
@Jerry@hear-me.social @pteryx@dice.camp not my points, just someone else’s article that I found quite informative the first and last time I thought “how hard can it be to host my own email?”
@Jerry@hear-me.social would adding those txt records cause any issue to a wildcard redirect I use for myself?
I have xxxxx.com and an auto redirect by my dns provider so that anything sent to name@xxxxx.com is forwarded to name@gmail.com so when I give out the address I can see if it’s been shared.
I like the idea of protecting against unauthorized use but wouldn’t want to lose my throwaway capability.
I find email servers to be akin to dark arts so am at a loss here tbh.
@b3lt3r@mastodon.b3lt3r.com I’m far from an expert, but if your redirect is at the server, and your server adds a “.forward” to the email, and does not alter anything, you should be fine because your SPF and DKIM should pass.
If your redirect is via an email client, or the server doesn’t add a .forward, it may alter the email slightly, but in a way sufficient for DKIM to fail because the hash won’t match any longer. But, I think in this case, if SPF passes, your email client would still accept it since the original DKIM passed before the forwarding.
It gets really complicated. Suggest you try it.
And this is based on my understanding, which, who knows?
@Jerry@hear-me.social ok - I’ll try it on a less critical domain first, thank you.
I run most of my own services from here to avoid any cloud usage but the one thing I do not dare to host is email - I can’t see any refinement in configuration/management has happened since the '70s :-)
Very good tip! Thank you.
