Yahoo email anti-spoofing policy breaks mailing lists

Yahoo moved to a more aggressive DMARC policy that creates email delivery issues on mailing lists for users, email experts said

In an attempt to block email spoofing attacks on addresses, Yahoo began imposing a stricter email validation policy that unfortunately breaks the usual workflow on legitimate mailing lists.

The problem is a new DMARC (Domain-based Message Authentication, Reporting and Conformance) "reject" policy advertised by Yahoo to third-party email servers, said John Levine, a long-time email infrastructure consultant and president of the Coalition Against Unsolicited Commercial Email (CAUCE), in a message sent to the Internet Engineering Task Force (IETF) mailing list Monday.

DMARC is a technical specification for implementing the SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) email validation and authentication mechanisms. These technologies were designed to prevent email address spoofing commonly used in spam and phishing attacks.

The goal of DMARC is to achieve a uniform implementation of SPF and DKIM among the top email service providers and other companies that want to benefit from email validation.

The specification introduces the concept of aligned identifiers, which requires the SPF or DKIM validation domains to be the same as or sub-domains of the domain for the email address in the "from" field. The domain owners can use a DMARC policy setting called "p=" to tell receiving email servers what should happen if the DMARC check fails. The possible values for this setting can be "none" or "reject."

Over the weekend Yahoo published a DMARC record with "p=reject" essentially telling all receiving email servers to reject emails from addresses that don't originate from its servers, Levine said.

While this is a good thing from an anti-spoofing perspective, it raises problems for legitimate mailing lists, according to the email expert.

"Lists invariably use their own bounce address in their own domain, so the SPF doesn't match," Levine said. "Lists generally modify messages via subject tags, body footers, attachment stripping, and other useful features that break the DKIM signature. So on even the most legitimate list mail like, say, the IETF's, most of the mail fails the DMARC assertions, not due to the lists doing anything 'wrong'."

With the new policy, when a Yahoo user sends an email to a mailing list, the list's server distributes that message to all subscribers, changing the headers and breaking DMARC validation. List subscribers with email accounts on servers that perform DMARC checks, such as Gmail, Hotmail (, Comcast or Yahoo itself, will reject the original message and respond back to the list with automated DMARC error messages.

For example, Gmail will respond with a message that reads: "smtp;550 5.7.1 Unauthenticated email from is not accepted due to domain's DMARC policy. Please contact administrator of domain if this was a legitimate mail."

So users of Gmail, Hotmail and other DMARC-enabled providers will not only fail to receive messages sent to the mailing list by Yahoo users, but will flood the list with bounce messages, risking to be bounced off the list themselves, Levine said.

The email expert recommended that mailing list operators suspend the list posting rights of users and ask them to re-subscribe to their lists with accounts from different email providers.

Yahoo did not immediately respond to an inquiry seeking clarification on whether its new DMARC policy is permanent or temporary.

A test of Yahoo's DMARC records Tuesday done with a tool on revealed that the "p=reject" setting was still in place for the domain. By comparison, had a policy record of "p=none," meaning it doesn't tell other email servers how to handle messages from addresses that fail DMARC checks.

Laura Tessmer Atkins, co-founder of email anti-spam consultancy firm Word to the Wise based in Palo Alto, California, also confirmed and documented the issue in a blog post Monday. She believes that Yahoo began advertising a "reject" policy because of a recent attack against Yahoo users that involved attackers compromising email accounts and sending unauthorized emails to their contacts.

"The attackers have modified their attacks and are now sending mail from Yahoo users to their contacts through other servers," Atkins said. "By publishing a p=reject record, Yahoo is telling other systems to not accept mail from Yahoo users if it doesn't come through Yahoo controlled servers. This includes the mail from the attackers, but also mail from regular Yahoo users that use another SMTP server, including bulk mail sent through ESPs [email service providers], and individual mail sent to mailing lists.", the industry group that oversees the development and adoption of the DMARC standard, did not immediately respond to a request for comment about the Yahoo situation. However, the frequently asked questions section of the group's website acknowledges the interoperability problems mailing lists can have with DMARC and offers some recommendations.

Join the CSO newsletter!

Error: Please check your email address.

Tags Internet Engineering Task ForceWord to the WiseInternet-based applications and servicesantispamonline safetysecurityMailinternetCompliance monitoringYahoo

More about Coalition Against Unsolicited Commercial EmailComcast CableHotmailIETFInternet Engineering Task ForceYahoo

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Lucian Constantin

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place