Comment by LinuxBender | Hacker News Reader

Comment by LinuxBender | Hacker News Reader

I will personally always use hard fail. If I need to relay mail then I configure the receiving site to make an exception for the relay. If that isn't possible then I do not relay. In a corporation this requires some level of discipline and knowing what is sending emails and why. Security teams should have a weekly test to see if they can spoof senders in their corporate email both from inside their company and from untrusted external IP's. I have found it too easy to spoof people in legal, security and leadership in most companies.

Adding to this, hard fail should be used with parked domains without exception. If a domain is not used for sending emails then it should have a null MX and hard fail SPF stating not to trust any IP's or domains.

    @  1d in mx 0 .
    @  1din txt "v=spf1 -all"
    @  1d in caa 0 issue ";"
    @  1d in caa 0 issuewild ";"
    dmarc  1d in txt "v=DMARC1;p=reject;sp=reject;pct=100;aspf=s;"
    _domainkey 1d in txt "v=DKIM1; p="
    _bimi 1d in txt "v=BIMI1; l=; a=;"
    *  1d in mx 0 .
    *  1d in txt "v=spf1 -all"
    *._domainkey 1d in txt "v=DKIM1; p="
    *  1d in caa 0 issue ";"
    *  1d in caa 0 issuewild ";"

> Adding to this, hard fail should be used with parked domains without exception. If a domain is not used for sending emails then it should have a null MX and hard fail SPF stating not to trust any IP's or domains.

This is correct, but this is also mentioned in the article multiple times.

To add to that, a DMARC record with a "reject" policy is also recommended for domains that are not supposed to send any email, see also: https://www.mailhardener.com/kb/hardening-unused-domains

Also null BIMI records as well, especially if one is going to use soft-fail. Or maybe a malware symbol.

> Also null BIMI records as well

Could be useful, but a successful attack on BIMI would require: - Getting access to the DNS of the domain (in which case the null record will simply be replaced) - Obtaining a VMC for the domain, which should not be possible due to the extended validation requirement for a VMC (such as: phone validation) - Spending ~$800 on a VMC

> especially if one is going to use soft-fail.

As explained in the article, if DMARC is deployed then softfail is equal to (hard) fail. With DMARC anything that is not an SPF pass, is not aligned, thus a fail.

The only exception here would be a very old legacy email system that doesn't support DMARC. But those will also not support BIMI anyway.

> Or maybe a malware symbol.

BIMI should always require a VMC. It should be impossible to obtain a VMC with a 'malware symbol'. Unless of course you are willing to pay a lot to get it registered as your company logo at your trademark office.

I have the same aside from CA related (I don't see the point, if I lose control of a domain TLS is not a priority, and I can't stop rogue CA issuing a certificate as CAA is basically unsupported) - also no bimi as it's a solution looking for a problem and not even in the right place.

As a result, emails from your domain will never reach anyone who has a "forwarding" email address: for example, someone who uses Cloudflare to manage their incoming email for their domains, and forwards it to their real email account.

This is a lot of people.

Why are you OK with that?

Reply on news.ycombinator.com