Welcome • User Guide
ToS • Privacy • Canary
Donate • Bugs • License

©2026 Poal.co

965

I have a friend who acts as a client for beer money at times. He recently changed email services and wound up with someone that runs a tight ship. All of a sudden, clients are calling him saying their emails are being rejected what's up?

I start looking at the addresses. Many of them are other small business suppliers that are depending on third-party third-parties like thomasnet, and they haven't touched configs since they day they were set up 15 years ago. Others, like GE, were quite surprising.

Turns out that in almost every case, these companies don't have a DMARC or SPF record set up. In particular, GE has no SPF record which really surprised me. If you can get into GE's mail server, there's nothing stopping you from validating and sending emails - but there's nothing stopping a secure email receiver from saying "I don't think you know who you are, rejected!"

If you're sending email professionally, there's absolutely no excuse to not have this set up. It took me about 30 minutes to do on my own mail service, and most of that was just reading about how to construct the proper record.

I have a friend who acts as a client for beer money at times. He recently changed email services and wound up with someone that runs a tight ship. All of a sudden, clients are calling him saying their emails are being rejected what's up? I start looking at the addresses. Many of them are other small business suppliers that are depending on third-party third-parties like thomasnet, and they haven't touched configs since they day they were set up 15 years ago. Others, like GE, were quite surprising. Turns out that in almost every case, these companies don't have a DMARC or SPF record set up. In particular, GE has no SPF record which really surprised me. If you can get into GE's mail server, there's nothing stopping you from validating and sending emails - but there's nothing stopping a secure email receiver from saying "I don't think you know who you are, rejected!" If you're sending email professionally, there's absolutely no excuse to not have this set up. It took me about 30 minutes to do on my own mail service, and most of that was just reading about how to construct the proper record.

(post is archived)

[–] • 1 pt

And open relays I'm sure.

No whitelist

Same type of company that would rather bgp-blackhole an entire range than actually try to mitigate

[–] • 1 pt

I'm sure there are other holes, but my only concern in this case is why the mail is being rejected.

If they've overlooked basic security, you know there are bigger problems elsewhere.

[–] • 0 pt

I worked at a place with open relays, and we'd get dinged on security scans for it every time. Reason was though that we had a whitelist. Everything else would just get dropped on the floor with no confirmation whatsoever, kind of like what firewalls do with packets. Tons of outside relays would keep trying to send us bs mail, and we basically just ignored them.

[–] • 1 pt

Affirmative action.

[–] • 1 pt

or just pay a dollar more and get on 365

[–] • 2 pts

Nooooooooooooooooooooooooooooooooooope.