Hacker News Reader

Comment by mehrdadn | Hacker News Reader

Weirdly enough, I've had this problem with DMARC, not SPF. It occurs on a very small fraction of emails from more "sensitive" domains, like a fraction of emails from one or two banks.

In particular, Gmail completely silently drops emails forwarded by hosts that aren't explicitly authorized by the sender's DMARC policy, which sucks because it means I can't forward such emails from my _own_ addresses on other domains to my _own_ Gmail account. I understand this is because the sender's DMARC policy says that the receiver should hard-reject any mail delivered by unauthorized middlemen, which seems naively short-sighted given that anyone can deliver email, and DKIM already lets the receiver verify the authenticity. (Is this even compliant behavior?)

Does anyone have a reasonable workaround for forwarding to Gmail in such cases?

View on HN

I’m afraid I don’t. This was in fact why I stopped hosting a mail server for friends, way back when. I realised that if most of them put their gmail address in ~/.forward, any spam they received on their account on my domain, gmail would count towards my domain / ip instead of the original sender. This is a fundamental flaw with current email implementations; there is no equivalent to something like the “trusted downstream proxies” list.[1]

I always wondered why gmail wouldn’t have a (per account) setting to say: “I am forwarding mail from this host / domain / address”, with corresponding trust of Received: headers chain. If I could then add a header in forwarded mails requiring that to be set, somehow, then we could avoid this SPF / DMARC problem entirely. The fundamentals are there (received: headers and DKIM). All we need is some last mile config :(

But it would promote decentralisation, so I’m not holding my breath.

[1] random search result of such an implementation: https://github.com/tornadoweb/tornado/pull/1864/files

But why doing email forwarding. If it is a custom domain, why not simply use gmail as your MX entries?

Maybe some aliases are forwarded or whatever. I could see myself doing it if I didn't get the warning above. (Thanks!)

In fact, I was possibly about to next month as a way to easily relay from an about to be disused address to a new address at gmail (or whatever my "friend" chooses to migrate to.)

Confused, how does that work? How would Gmail know which mailbox to put an email it gets for an address in a different domain?

Gmail like pretty much every other providers offers to manage custom domains. You point your mx entries to them, you setup the mailbox and aliases on the google side, and you have a emails in yourdomain.com running using gmail behind the scene. Just google "gmail custom domain".

Oh, so you mean GSuite, not Gmail. That severely restricts your freedom with the mailboxes and addresses you can have on your own domain.

> That severely restricts your freedom with the mailboxes and addresses you can have on your own domain.

How so?

The e-mail routing in Gsuite is very customizable, the only downside to using Gsuite (basic) is that it'll put you down $5 a month and if you use email aliases you can only send from those aliases via gmail.com (or a mail client that supports them).

It was a shared host for different users. None of them wanted to manage another inbox, they just wanted incoming mail forwarded to their personal mail (gmail, hotmail, whatever).

Compare to e.g. an outsourcing firm who wants their contractors to be reachable at duder@dudesinc.com, but doesn’t want them all to have to manage another inbox. This is very hard to achieve, due to the problem mentioned above.

This was not an actual business , just friends playing around with servers back in uni. But it made me realise this is a pretty fundamental issue with SMTP. The protocol is doomed to centralise.

> I realised that if most of them put their gmail address in ~/.forward, any spam they received on their account on my domain, gmail would count towards my domain / ip instead of the original sender.

I had that same problem; I ended up adding all those users and addresses to /etc/postfix/relocated.

You could use IMAP to push the emails to the Gmail account (either by dropping them to a maildir and periodically syncing, or using a script to push as they are received, e.g. https://stackoverflow.com/a/11973425)

Ha ha. Imap hacked into a mail delivery system. Except that it requires to trust the guy who runs the forwarding server with your gmail credentials.

Not necessarily, you can use Oauth2 tokens extension on gmail; that way you don't need to hand over your password(s).

Mind you it does nothing to protect you against the token bearer fooling with your mailbox.

That’s horrible :p I love it.

Unfortunately not a realistic solution if you want to offer forwarding to your users without holding their hand and assuming even more config and management woes.

This was a shared host, with a domain, and a bunch of user accounts. In theory, every user does 'echo me@ilovemomma.com > ~/.forward' on first login and they’re all set! Old school UNIX elegance. But in practice, it marks the start of a slow descent into the spam swamp.

The "correct" way to handle this is to not forward the mail at all. Instead, deliver it to the user's mailbox normally.

The user then adds this "external account/mailbox" in their Gmail settings and Google will automatically retrieve any mail from that mailbox (via POP3) and place it in their Gmail account.

I have an old, shared webhost with a lot of users who want to forward emails to gmail, but aren't willing to pay for gsuite to get a custom domain and stop using my webhost for forwarding. Plus gmail isn't very good with custom filter rules.

I had most of the traffic moved to procmail/spamassassin, and added greylisting, but there is still enough spam going to gmail that I was having deliverability problems. These show themselves as gmail giving soft fails and a huge queue building up.

My current solution is 2-fold:

1) It turns out that gmail is likely to soft-fail the spammiest incoming messages. So I have a script that deletes them from the queue, with rules that match addresses that get the most spam. That way my IP only gets 1 badness point per spam message, not dozens for all of the retries.

2) I moved the outgoing email I care about to a different IP.

Reply on news.ycombinator.com