Re: [mailop] gmail rejecting for invalid SPF/DKIM when there isn't any?

2022-08-27 Thread Jarland Donnell via mailop
It was purely observational, I thought others had already noticed it. It consumed a lot of support time on our side. Maybe I'll try to pull the data to get a better idea of how it looked by the numbers. On 2022-08-27 22:28, Darrell Budic via mailop wrote: Was there any published notification a

Re: [mailop] gmail rejecting for invalid SPF/DKIM when there isn't any?

2022-08-27 Thread Darrell Budic via mailop
Was there any published notification about this? Not that there’s a good place for it, but between mailop and nanog, I’d have thought I’d have seen it… At any rate, this error message seems like it would be better as “Gmail now requires senders to have SPF and/or DKIM enabled to send mail to Gma

Re: [mailop] gmail rejecting for invalid SPF/DKIM when there isn't any?

2022-08-27 Thread Darrell Budic via mailop
It was just added about the time I was sending that email, so it wasn’t there when my customer got the bounces. I imagine you are seeing caching and it should be solid soon. > On Aug 27, 2022, at 6:04 PM, Ángel via mailop wrote: > > On 2022-08-27 at 17:09 -0500, Darrell Budic wrote: >> Anyone

Re: [mailop] facebook, help?

2022-08-27 Thread Dave Lugo via mailop
Also ensure their passwords are all unique, this sounds like a password reuse hack. Also, does their cell number still make and receive calls and texts, and have you checked with On Sun, 28 Aug 2022, Chris Woods wrote: Chances are the SMS was the first thing changed to prevent you regaining a

Re: [mailop] facebook, help?

2022-08-27 Thread Chris Woods via mailop
On Sun, 28 Aug 2022, 00:25 Dave Lugo via mailop, wrote: > My fiance's FB account was hijacked by a bad actor today. The bad actor > changed the email address on the account, and despite multiple attempts to > recover the account using SMS, the SMS texts don't arrive (dunno if > her carrier veri

[mailop] facebook, help?

2022-08-27 Thread Dave Lugo via mailop
My fiance's FB account was hijacked by a bad actor today. The bad actor changed the email address on the account, and despite multiple attempts to recover the account using SMS, the SMS texts don't arrive (dunno if her carrier verizon is having SMS issues or not) Can anyone from FB please, pl

Re: [mailop] gmail rejecting for invalid SPF/DKIM when there isn't any?

2022-08-27 Thread Ángel via mailop
On 2022-08-27 at 17:09 -0500, Darrell Budic wrote: > Anyone else seeing this? Customer of mine just got some bounces from > gmail for invalid SPF/DKIM. He doesn’t have either, so I’m not sure > what this is about? > > Mind you, I did send him to setup a valid SPF entry, and > authentication is goo

Re: [mailop] gmail rejecting for invalid SPF/DKIM when there isn't any?

2022-08-27 Thread Jarland Donnell via mailop
Google has recent started requiring SPF. I don't know if they require it 100% of the time but they do now reject emails from domains that either don't have it, or have it improperly configured, and they won't accept it from those domains until it's fixed. It has helped me a good bit, making it

[mailop] gmail rejecting for invalid SPF/DKIM when there isn't any?

2022-08-27 Thread Darrell Budic via mailop
Anyone else seeing this? Customer of mine just got some bounces from gmail for invalid SPF/DKIM. He doesn’t have either, so I’m not sure what this is about? Mind you, I did send him to setup a valid SPF entry, and authentication is good, but this seems like a misleading error message... > >

Re: [mailop] Research project on SPF validation: Is your server violating RFC standards for SPF resolution?

2022-08-27 Thread Tobias Fiebig via mailop
Hello John, > If it's opt-in, please identify all of the IPs that send mail or DNS or web > queries so those of us who have not opted in can block them. I just started going through the setup built at VT and found several points where there will have to be some serious re-design of several compon

Re: [mailop] Research project on SPF validation: Is your server violating RFC standards for SPF resolution?

2022-08-27 Thread Tobias Fiebig via mailop
Hello Bill, > I refuse to participate in your research, as all evidence I have is that VT > is grossly unethical and allows incompetents to run research projects. I hear your frustration with this, and will not defend the measurements that took place in February. As outlined below, we will work o

Re: [mailop] Research project on SPF validation: Is your server violating RFC standards for SPF resolution?

2022-08-27 Thread John Levine via mailop
It appears that Tobias Fiebig via mailop said: >Heho, >Thank you all for your feedback, and especially to Simon for pointing out the >issue in February. This should, of >course, not happen, and is part of the reason why we are moving this to strict >opt-in measurements. If it's opt-in, please

Re: [mailop] Research project on SPF validation: Is your server violating RFC standards for SPF resolution?

2022-08-27 Thread Bill Cole via mailop
On 2022-08-27 at 14:07:50 UTC-0400 (Sat, 27 Aug 2022 20:07:50 +0200) Tobias Fiebig via mailop is rumored to have said: Heho, Thank you all for your feedback, and especially to Simon for pointing out the issue in February. This should, of course, not happen, and is part of the reason why we ar

Re: [mailop] Research project on SPF validation: Is your server violating RFC standards for SPF resolution?

2022-08-27 Thread Tobias Fiebig via mailop
Heho, Thank you all for your feedback, and especially to Simon for pointing out the issue in February. This should, of course, not happen, and is part of the reason why we are moving this to strict opt-in measurements. I discussed your points with the project lead (Taejoong “tijay” Chung ), who

Re: [mailop] Research project on SPF validation: Is your server violating RFC standards for SPF resolution?

2022-08-27 Thread Simon Arlott via mailop
On 25/08/2022 11:39, Tobias Fiebig via mailop wrote: > An attacker may use an infinite number of SPF referrals in their SPF setting > and can send an email to a vulnerable mail server which would make the SMTP > server make a whole lot of DNS queries. By exploiting this vulnerability, an > attac