Subject: Don't shoot the messenger... AOL is publishing DMARC p=reject as of today.

From: "MH Michael Hammer (5304)" <[email-masked]>
Date: Tue, 22 Apr 2014 21:01:51 +0000

As I had indicated in a previous post, I expected that AOL might follow Yahoo in publishing p=reject as a means of mitigating a specific type of abuse they were experiencing.

http://postmaster-blog.aol.com/2014/04/22/aol-mail-updates-dmarc-policy-to-reject/

Mike

---

From: "John Levine" <[email-masked]>
Date: 22 Apr 2014 22:04:02 -0000

>As I had indicated in a previous post, I expected that AOL might follow Yahoo in publishing p=reject as a means of mitigating a
>specific type of abuse they were experiencing.
>

This certainly confirms the theory that the members of the DMARC
cartel believe that they have sufficient market power to force
everyone else to bear the costs of the collateral damage of their
poorly targeted anti-abuse efforts.  Who knows, they might even be
right.  

In AOL's case, I presume it's because it's become painfully apparent
that crooks are stealing vast numbers of AOL address books and
spamming to them from the matching AOL user addresses. This is loudly
slamming the barn door after the horse left.  Too bad for all the
people whose feet were crushed as they did so.

R's,
John

---

From: [email-masked] (Martin Rex)
Date: Wed, 23 Apr 2014 01:55:57 +0200 (CEST)

> people whose feet were crushed as they did so.

I received spam EMail from a friend with @yahoo.com account on 26-Mar-2014
based on what appears to be a stolen address book.

It did not come through any yahoo mail servers, carried 19 additional 
email addresses from my friends address book in Cc: and contained an
URL to some aggressive advertisement site besides the first+last real name
of my friend (subject was also only my friends first+last name).

I don't know whether that site also served any malware along with the
aggressive advertisement, I opened it in a virtual environment with
a browser having active content disabled.  The advertisement was
shown in my local language (German) although I was the only German
among the visible recipients.

Btw. I can successfully send myself EMail with fake @yahoo.com in From:
to my work Email account (where I originally received that spam),
and there is no problem in receiving. (Our comany email does not seem
to perform any of the crazy DMARC processing).

-Martin