Questions on AOL/Yahoo's DMARC

jeffpan · 28 Apr 2020, 09:53 AM

For a regular company domain, DMARC policy could be setup to "reject", such as google:

Quote:

_dmarc.google.com. 299 IN TXT "v=DMARC1; p=reject; rua=mailto:mailauth-reports@google.com"

But if the domain is open registration for email, DMARC policy should not setup to "reject", that would make a lot of troubles for both users and the administrator (considering the open mailing lists use case). For example, gmail.com has p=none in its DMARC:

Quote:

_dmarc.gmail.com. 599 IN TXT "v=DMARC1; p=none; sp=quarantine; rua=mailto:mailauth-reports@google.com"

I am not sure, since AOL.com, yahoo.com, Mail.ru are opened for registration, why they have also p=reject setup in their DMARC?

Quote:

_dmarc.aol.com. 2728 IN TXT "v=DMARC1; p=reject; pct=100; rua=mailto:d@rua.agari.com; ruf=mailto:d@ruf.agari.com;"
_dmarc.yahoo.com. 1450 IN TXT "v=DMARC1; p=reject; pct=100; rua=mailto:dmarc_y_rua@yahoo.com;"
_dmarc.mail.ru. 599 IN TXT "v=DMARC1;p=reject;rua=mailto:d@rua.agari.com,mai" "lto:dmarc_rua@corp.mail.ru"

These setup will suck in many ways (break any forwarding and mailing list). I don't know the reasons.

SideshowBob · 30 Apr 2020, 12:36 AM

A few year ago Yahoo was relaying a lot of spam, but much more spam was spoofing Yahoo. A lot of receiving servers were filtering Yahoo domains more aggressively than DMARC reject.

I don't think the reject policy is a problem for most of their users. Not many people care about posting to mailings lists. Even if they do they can create a separate account for that elsewhere, which is a good idea anyway.

Rejection after forwarding is mostly a problem for the receiver. If you do that you have to pick the forwarder and target carefully to minimize problems - otherwise Yahoo is likely to be the tip of the iceberg.

jarland · 30 Apr 2020, 04:00 AM

Yahoo has actually been ahead of the curve on a lot of heavy handed anti-spam policies in the last decade, often to the end-user's discontent. I think it was late 2013 (most people started heavily noticing around early 2014) that they broke mailman installations everywhere with their attempts to stop spoofing of yahoo.com emails. This was a good source on the matter:

https://mailarchive.ietf.org/arch/ms...eMD1ENKZyb9tA/

They even blocked roughly 1% of the internet from emailing their servers for a bit shortly after, but backed down on that after some internal talks (I remember this from when I worked at HostGator/EIG).

I think it's okay to say that if you or someone you know uses Yahoo you have to live with certain limitations. Probably wouldn't recommend anyone opt into it willingly though. You can pretty much bet on two things when you go there. First, your password will be stolen and you'll be notified sometime within the next decade. Second, if your "From" header has Yahoo in it it'll usually be rejected unless sent directly to the final recipient.

TenFour · 30 Apr 2020, 07:36 PM

I find it surprising how many people still have and use Yahoo addresses every day. There must be something they're doing right! One guy I hear from regularly uses Yahoo as his main personal email address and he works in the email marketing business. I manage some fairly large email lists and there are still lots of Yahoo addresses (and other oldies like AOL) out in the wild.

30 Apr 2020, 04:00 AM	#3
jarland Essential Contributor Join Date: Apr 2014 Posts: 399 Representative of: MXRoute.com	Yahoo has actually been ahead of the curve on a lot of heavy handed anti-spam policies in the last decade, often to the end-user's discontent. I think it was late 2013 (most people started heavily noticing around early 2014) that they broke mailman installations everywhere with their attempts to stop spoofing of yahoo.com emails. This was a good source on the matter: https://mailarchive.ietf.org/arch/ms...eMD1ENKZyb9tA/ They even blocked roughly 1% of the internet from emailing their servers for a bit shortly after, but backed down on that after some internal talks (I remember this from when I worked at HostGator/EIG). I think it's okay to say that if you or someone you know uses Yahoo you have to live with certain limitations. Probably wouldn't recommend anyone opt into it willingly though. You can pretty much bet on two things when you go there. First, your password will be stolen and you'll be notified sometime within the next decade. Second, if your "From" header has Yahoo in it it'll usually be rejected unless sent directly to the final recipient. Last edited by jarland : 30 Apr 2020 at 04:07 AM.

30 Apr 2020, 12:36 AM	#2
SideshowBob Essential Contributor Join Date: Jan 2017 Posts: 278	A few year ago Yahoo was relaying a lot of spam, but much more spam was spoofing Yahoo. A lot of receiving servers were filtering Yahoo domains more aggressively than DMARC reject. I don't think the reject policy is a problem for most of their users. Not many people care about posting to mailings lists. Even if they do they can create a separate account for that elsewhere, which is a good idea anyway. Rejection after forwarding is mostly a problem for the receiver. If you do that you have to pick the forwarder and target carefully to minimize problems - otherwise Yahoo is likely to be the tip of the iceberg.

30 Apr 2020, 07:36 PM	#4
TenFour Master of the @ Join Date: Feb 2017 Location: USA Posts: 1,722	I find it surprising how many people still have and use Yahoo addresses every day. There must be something they're doing right! One guy I hear from regularly uses Yahoo as his main personal email address and he works in the email marketing business. I manage some fairly large email lists and there are still lots of Yahoo addresses (and other oldies like AOL) out in the wild.