Top all-time · #9399
M
Mailhardener
Company blog · mailhardener.com/blog · on HN as LeonMsecurityweb
Mailhardener is the company blog at mailhardener.com, writing about security and web. Since 2019, 8 different Hacker News readers have linked it 35 times, most often “Hardening unused (sub)domains”. No feed was found, so read it on the site itself.
No feed foundVisit the blog
35mentions?
8HN people?
2019–2025first – last linked?
Too few sampled comments (4) to say how often HN recommends it.?
Why HN links it
Commenters cite Mailhardener's guides and tools on SPF, DKIM, DMARC and MTA-STS for email setup, including its MTA-STS validator. The comments do not judge the writing itself.
Summarised by Claude from a sample of 4 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Mailhardener helps you secure and monitor your domain from being used for fraud and spam.
Most-linked posts?
- Hardening unused (sub)domains3 people · 3 mentions · first linked 2022-11-17
- /2 people · 9 mentions · first linked 2019-04-02
What Hacker News says?
I run a mail monitoring service [0], and we hear this complaint every now and then. A couple of things that regularly seems to trigger false positives in spam algorithms: - no or misconfigured SPF and/or DKIM - no or misconfigured reverse-DNS - automatically included footer texts (confidentiality, copyright, safe a tree don't print, etc) - regular automatic replies from the domain (such as out of office notification…
Comment linking /
on “Google Is Eating Our Mail”Submitted Hardening unused (sub)domains as a story · 238 points
HN discussionNo, it is not. It really grinds my gears if people are spreading misinformation about 'being on the same network as a spammer', 'indiscriminate blacklists' and corporate overlords for being the reason on why their email is not being delivered. Spam filters have been content driven for a long time now. IP addresses and domain names are ephemeral and so are 'blacklists'. With the amount of spam being send, we would ha…
Comment linking /
on “Gmail having issues”Submitted How to Enter TXT Values in Google Cloud DNS as a story · 6 points
HN discussion> 1. Don't use strict (adkim=s; aspf=s) if you expect your emails to be forwarded ( https://www.dmarcanalyzer.com/forwarding-within-dmarc/ ). Neither of this settings have anything to do with forwarding. aspf and adkim are for SPF/DKIM alignment , where 'r' (relaxed) allows subdomains, and 's' (strict) does not. aspf=s requires RFC5321.MailFrom and RFC5322.From to match exactly (no subdomain difference) for the SPF…
Comment linking /kb/dmarc
on “Email Authenticity 101: DKIM, Dmarc, and SPF”Submitted Common Made Mistakes with SPF as a story · 6 points
HN discussionAt Mailhardener we built a BIMI validator tool [0], we also work with the AuthIndicators Working Group (the authors of the BIMI standard) to refine the standard. Please be aware that the BIMI standard is far from finished. There are some serious documentation ambiguities that pose a risk to how well BIMI might function, and how email providers will adopt the technology. Obviously, the CAs are now pushing hard for BI…
Comment linking /tools/bimi-validator
on “Email Authenticity 101: DKIM, Dmarc, and SPF”Submitted Email Hardening Guide as a story · 5 points
HN discussionTry https://www.mailhardener.com which includes (amongst many other features) DMARC and SMTP TLS report aggregation. You can use it for free for personal (non-commercial) domains. Paid tiers (starting at 19 EUR/month) also offer additional services such as MTA-STS policy hosting and BIMI asset hosting. Disclosure: I'm the founder of Mailhardener.
Comment linking /
on “See how DMARC, SPF, and DKIM work interactively”Submitted Microsoft has begun sending SMTP TLS reports as a story · 4 points
HN discussionExcept that the OP did not post all the information to verify. The IP address does belong to the fbi.gov (both forward and reverse DNS lookups check out). The DKIM public key does exist at the given selector [0], but without the complete raw message, it is not possible to verify the signature. He also excluded the authentication-result header from his post. [0] https://www.mailhardener.com/tools/dkim-validator?domai…
Comment linking /tools/dkim-validator?domain=cjis._domainkey.fbi.gov
on “Email from FBI Looks Odd”Submitted Use SPF softfail, not (hard) fail as a story · 3 points
HN discussionSelf hosting has become harder due to email abuse (spam, phishing, impersonation, etc) and the measures against this that have been introduced. Following a guide to setup a basic email service is quite easy to do, but after a while the lack of proper implementation and maintenance of the standards will start to cause deliverability issues. Those are frustrating and most end up writing a long rant on why Google is ev…
Comment linking /kb/
on “Gmail marking email from me as spam”Submitted Deploying Dane (TLSA) for SMTP with OpenSSL as a story · 3 points
HN discussionI run an email security/monitoring business [0], and we hear this issue with Gmail a lot, in fact: we have been bitten by it as well during the early days. The problem at hand is that it is really hard to debug situations like this. Google won't tell you why a particular email is blocked, because that information will be immediately exploited by spammers. We build our software suite because we found that mistakes in…
Comment linking /tools/dmarc-validator?domain=rafa.eu.org
on “Gmail marking email from me as spam”Submitted Hardening Unused Mail Domains as a story · 2 points
HN discussionhttps://www.mailhardener.com is another great "validator" and more for a personal email domain
Comment linking /
on “Understanding SPF, DKIM, and DMARC: A Simple Guide”Submitted Do not flatten your SPF record as a story · 2 points
HN discussion>Can you tell me how you did this? It'll be a bit help! Sorry. It was a few months ago, so I can't remember the intricate details. And my config [as I said previously] was slightly out of the norm. But I did use this site which checks the state of your MTA-STS config and gives you a few clues as to what you need to twiddle: https://www.mailhardener.com/tools/mta-sts-validator EDIT: have you tried the MIAB forums? Th…
Comment linking /tools/mta-sts-validator
on “Self-hosted email is the hardest it's ever been, but also the easiest”Submitted Email Address Types Explained as a story · 1 points
HN discussionHowever, the wide use of MTA-STS is quite recent so downgrade attacks have been possible. In fact, Fastmail seems to currently be messing up MTA-STS, I'm not sure if they are intending to enable it or not. https://www.mailhardener.com/kb/mta-sts
Comment linking /kb/mta-sts
on “Why can't my mom email me?”Yes and no. It certainly is possible to get good deliverability, but you gotta play by the rules (which is: all the RFCs). But when you do, there are also a lot of poorly configured email servers out there that don't comply to the RFCs at all, so email services need some tolerance to processing email from badly configured sources. It is almost always a compromise. It is easy to get an email server running initially,…
Comment linking /
on “Maddy: Composable all-in-one mail server in Go”> Can you have a policy like that? No you cannot, like you said: DMARC passes if either SPF or DKIM passes. But what you can do is use the 'aspf' and 'adkim' settings to force strict alignment on SPF and/or DKIM for DMARC to pass. We see some of our [0] customers using strict SPF alignment to basically force DMARC SPF alignment to fail most of the time, thus effectively forcing a DKIM requirement for DMARC to pass.…
Comment linking /
on “Sending SPF and DMARC passing mail as any Gmail or G Suite customer”> with a HSTS-like directive hosted in DNS. I think you are talking about MTA-STS (rfc8461) [0]. It is currently being adopted by the larger email services (Google, Microsoft). MTA-STS is not 'hosted' in DNS, but published via a policy service over HTTPS, so it uses PKI. I work for Mailhardener, we offer MTA-STS policy services as a service [1]. We've seen an increased interest of MTA-STS recently, likely due to Mic…
Comment linking /blog/introducing-hosted-mta-sts
on “SMTP protocol basics from scratch in Go: receiving email from Gmail”Ed25519 curves are currently being adopted for DKIM in RFC8463 [0]. I I wrote an article about this [1], where I concluded that Ed25519 is an improvement for DKIM over RSA (smaller keys, deprecation of SHA1). However, this finding may have big impact on the adoption rate of Ed25519 for DKIM. Specifically for DKIM validators (MTAs). MTAs are already amongst the worst offenders when it comes to not adhering to the sta…
Comment linking /kb/how-to-use-dkim-with-ed25519
on “It’s 255:19AM. Do you know what your validation criteria are?”I've written a DMARC guide here: [0] If you want to use DMARC, you should use an aggregation tool such as ours to process the reports. You typically start with the DMARC policy in 'none' mode, which only enables reporting. Using the reports you verify that all legitimate senders are correctly signing email with DKIM (and preferably are also SPF aligned) before you switch to a 'quarantine' or 'reject' DMARC policy. […
Comment linking /kb/dmarc
on “DKIM Demystified”I've just finished a Stripe integration[0]. Given Stripe's developer first reputation I thought this would an easy job that wouldn't take more than a couple of days. Boy was I wrong! In the end, it took me about 3 weeks. Small disclaimer here, I was implementing Stripe Billing, not Stripe Payments. The Billing suite is a lot more complicated compared to the Payment suite. Nonetheless I took me a really long time to…
Comment linking /
on “Implementing API Billing with Stripe”A message is not 'transmitted via MTA-STS', it is transmitted via SMTP that uses TLS (SSL) to secure the connection between mailservers. MTA-STS [0] is a method to publish a policy on whether email servers (known as Mail Transfer Agents, or MTA's) are allowed to use insecure (non-TLS) connections for email from your domain. MTA-STS is needed because the system to deliver email over the internet (SMTP) has a fallback…
Comment linking /
on “Making email more secure with MTA-STS standard”I get reports showing attempts at least one a month per domain, a few in a week trying root and then subdomains. So I do like the fact that I know the policy I have implemented is useful. I do wish, however, that there was more useful information in the reports and that a variation of forensic reporting was more of a thing. But you're spot on with finding gaps. It's basically the premise for every commercial DMARC p…
Comment linking /
on “I figured out how DMARC works, and it almost broke me”Be careful with doing this, be sure you understand the implications of simply copy/pasting such an SPF record. For most situations, your MX (which is inbound email) may not necessarily be sending (outbound) email. For example: when using O365 or Google Workspace (Gmail), then these are always separated. You need to use the 'include' mechanism for your email inbox providers, and not the 'mx' mechanism. Leaving the 'm…
Comment linking /kb/spf
on “Gmail randomly(?) requires “new senders” to have SPF records since November '22”