Sporadic CJD is diagnosis of exclusion. That it happens spontaneously is a hypothesis, there might be root cause(s) that we simply don't know yet.
731 karma · joined June 6, 2020
And if the most privileged and job-secure people on the planet can't take the risk of undermining their FAANG overlords for the sake of humanity, who will?
Never understood, why others are so keen to protect employer given company will throw under the bus any of us in a blink of an eye.
Parent is making distinction between credit cards and banks.
Incidentally, this discussion is filled with people who have no idea how payments are authorized.
Your configuration is trivially spoofable by setting Envelope Sender to something attacker controls (and thus it will pass SPF), while still placing your domain in the From header.
If you read DKIM RFC it actually only specifies how to sign and verify the email signature, but does not mandate exact checks recipient should do to figure out authenticity. E.g. technically Microsoft could send mail from @gmail.com address and use "d=outlook.com" in the signature - the signature would be valid, but obviously it wouldn't make it authentic (meaning such mail wouldn't be authorized by Google). Although common sense dictates that there should be some sort of connection between domain seen in From header and the one that's DKIM-signing the mail (and most real-world implementations will do some kind of checks), RFC deliberately does not standardize these steps.
The intended standard that should have clarified these issues was ADSP, but it wasn't well received and now we have DMARC which handles both SPF and DKIM together (this is better for deliverability as mails that fail one of these checks might still pass another).
There's no secret sauce but there is a myriad of ways to shoot yourself in the foot when setting up a mail server from scratch. E.g. many standard setups may try delivering email over IPv6 if available which currently is a terrible idea but might be completely opaque to the user. Obviously, the results will also depend on what is it that you're sending as everyone uses point-based (or even ML) systems nowadays and headers + contents can earn you either negative or positive points.
That said DKIM is not enough because that standard does not have a way to signal recipient that your domain has DKIM set up in the first place (and you promise that all your mails should always be signed).
It’s kind of funny but essentially hacker does not need to spoof DKIM because they can just omit it and recipient won’t be able to know that it should have been present in the first place. Btw, there was proposal to add a feature that could be used for this signaling but it didn’t get adopted, so DMARC is the only practical solution right now.