Comment by brightball
11 hours ago
> virtually all the spam coming in had valid SPF / DKIM / DMARC, as do most of the phishing attacks.
This should create a means to go after the domain owners via registrar and trail of ownership, even so far as blocking email from the domain.
Forcing the spammers to pass DMARC creates a burden and an evidence trail that didn't exist before.
Can we use DMARC to ask Gmail to close registrations? Google Calendar to allow far fewer people the ability to send invite notifications? Firebase to close registrations? Azure? Microsoft 365? AWS SES?
It feels like the biggest spammers have swung back to just abusing SaaS and getting SPF / DKIM / DMARC for free from one of the big email providers.
Exactly this. Spammers have the technical competence to overcome any technical hurdle, so using evidence of technical competence achieves nothing.
If it were possible to charge $0.25/email for delivery, I'd be more than happy . However, I'm sure large tech firms will need to say that is "too hard to implement at scale".
Stamp costs don't stop snail mail spam, either, unfortunately. I would be concerned if we added something like bitcoin fees to email delivery rather than curtail spam it would just further encourage grifters seeking ROI on their spam deliveries.
3 replies →
What spammers are using the same domain for longer than couple of hours?
What do you expect to achieve by blocking an already abandoned domain?
@gmail.com and @outlook.com are like 90% of the spam I receive. What’s missing is effective accountability for those two companies hosting persistent spam groups who operate for months unimpeded.
They're generally hosted on a google or microsoft 365 or something slightly less shady. Good luck with that.