On Sun, 3 Apr 2022, Jeroen Massar wrote:
Hi Dan,
Hope the rest of the world is treating you decently!
There are a lot of bits and bobs that one has to get right for mail to flow,
amongst which:
- IP -> PTR lookup -> that hostname lookup, and match to IP again
(https://en.wikipedia.org/wiki/Forward-confirmed_reverse_DNS)
- SPF
- DKIM
- DMARC
- ARC (for mailinglists)
- SRS (When forwarding, rewrite the From and resign DKIM, and then ARC-sign
that)
- Decent TLS
- MTA-STS
And that list grows and grows... and grows and grows. It is kinda a test if one
has actually bothered to configure a setup, and not just are randomly sending
an email by just telneting from a random server. Of course the large spam
outfits have this fully automated and configured, so that their
spam^Wadvertising comes through.
A wee little test tells that there are a few improvements to be made at minimum:
https://internet.nl/mail/isc.org/
• Not all authenticity marks against email phishing (DMARC, DKIM and
SPF)
We have SPF, DKIM signing, and a DMARC policy that sets p=none.
We're not setting p=reject, considering the number of mailing lists our
users are on that are outdated or based on EOL software (including this
one which depends on python 2.7, and including our own which have the same
problem). It's impossible to know, from the outside, how mailing lists
are configured. Mailman3 is...special. That's a rant for another time.
We get about an email a week from someone emailing security-officer@
trying to get a bug bounty telling us we should set p=reject. There's an
ecosystem for this stuff.
I don't think this affects our domain's "reputation".
• Failed :Mail server connection not or insufficiently secured
(STARTTLS and DANE)
This has little to do with what ciphers we support outbound, and little to
do with our reputation.
Unlike HTTPS, the failback to startTLS not working is plain-text. Setting
a stricter cipher requirement would result in more mail being delivered in
the clear.
This is a somewhat broken test.
-Dan
--
--------Dan Mahoney--------
Techie, Sysadmin, WebGeek
Gushi on efnet/undernet IRC
FB: fb.com/DanielMahoneyIV
LI: linkedin.com/in/gushi
Site: http://www.gushi.org
---------------------------
