Skip to main content

Home/ Future of the Web/ Group items tagged DMARC

Rss Feed Group items tagged

Paul Merrell

Yahoo breaks every mailing list in the world including the IETF's - 0 views

  • DMARC is what one might call an emerging e-mail security scheme. There's a draft on it at draft-kucherawy-dmarc-base-04, intended for the independent stream. It's emerging pretty fast, since many of the largest mail systems in the world have already implemented it, including Gmail, Hotmail/MSN/Outlook, Comcast, and Yahoo.
  • The reason this matters is that over the weekend Yahoo published a DMARC record with a policy saying to reject all mail that fails DMARC. I noticed this because I got a blizzard of bounces from my church mailing list, when a subscriber sent a message from her account, and the list got a whole bunch of rejections from gmail, Yahoo, Hotmail, Comcast, and Yahoo itself. This is definitely a DMARC problem, the bounces say so. The problem for mailing lists isn't limited to the Yahoo subscribers. Since Yahoo mail provokes bounces from lots of other mail systems, innocent subscribers at Gmail, Hotmail, etc. not only won't get Yahoo subscribers' messages, but all those bounces are likely to bounce them off the lists. A few years back we had a similar problem due to an overstrict implementation of DKIM ADSP, but in this case, DMARC is doing what Yahoo is telling it to do. Suggestions: * Suspend posting permission of all addresses, to limit damage * Tell Yahoo users to get a new mail account somewhere else, pronto, if they want to continue using mailing lists * If you know people at Yahoo, ask if perhaps this wasn't such a good idea
    Short story: Check your SPAM folder for email from folks who email you from Yahoo accounts. That's where it's currently going. (They got rid of the first bug but created a new one in the process. Your Spam folder is where they're currently being routed.)
1 - 1 of 1
Showing 20 items per page