[CentOS] Passwords in plain text

[Alice Wonder]

On 06/17/2018 08:52 AM, Michael Hennebry via CentOS wrote:
> I'm petty sure I messed up attributions, so am deleting them.
>
>>> I believe this is a DMARC issue. Yahoo, among other places, has set
>>> their dmarc records to p=reject:
>
>>> So, if your mail hosting provider enforces dmarc,(gmail does) and you
>>> get mail from a list that doesn't rewrite the headers, and people
>>> from places like yahoo post to the list, you'll likely get some form
>>> of warning about being being kicked off the mailing list every now
>>> and then. The frequency depends on how often people from p=reject
>>> places post, and what the settings are for bounce handling of the
>>> mailing list in question.
>
>> This is indeed what happened.  An email from yahoo.com.uk caused gmail
>> to reject all the mails sent by that user because of the yahoo DMARC
>> settings.
>
> Say it isn't so: *An* e-mail, just *one* from yahoo.com.uk
> caused every gmail user to have his account disabled.
>
> I'd heard of the DMARC thing with mailing lists before,
> but had not known it enabled single e-mails of mass destruction.

I run dmarc on my mail server but only in report mode, it doesn't reject.

I did it as a test (for years) and am fully convinced that dmarc is 
worthless for real world protection.

Numerous mail lists out there are configured in such a way that dmarc 
gets triggered and that just isn't going to change.

It's a neat idea but it's not backwards compatible with the way SMTP 
already works.

I can not recommend its use. I do recommend mail server software update 
if possible to be compatible but I just can not recommend mail servers 
enforce dmarc.

DKIM is a good thing, but dmarc breaks things too badly.

Even DKIM though is of limited usefulness - it seems the spammer 
blacklists don't really care. Even with proper DKIM signature on a 
domain with correct reverse DNS set up for years, they will still add 
you to the spam blacklist if any other host on your subnet is identified 
as a spammer.

So even the blacklists don't really utilize this anti-spam anti-spoof 
technology, which makes it kind of worthless.

Using DKIM as one of several factors in spamassassin though is possibly 
helpful, though most spammers these days have a validating DKIM sig.