• 0 Posts
  • 7 Comments
Joined 10 months ago
cake
Cake day: September 17th, 2023

help-circle

  • TL;DR you can send emails from .onion addresses if you want, but no clearnet server is going to accept them.

    So when you send an email, you can actually put whatever you want in the from header. I could send an email that says from “made.this.up@website.doesnotexist”. The protocol doesn’t care.

    Do you know who does care? The email server you’re sending messages to, because spammers and scammers love to try and send email with fake from addresses.

    So, there’s an entire verification system in place that involves looking up public keys from the website that the email claims to be from. (this is a gross over simplification. Look up SPF, DKIM, and DMARC for more info). The problem is you can’t even reach .onion sites from the clearnet to do the lookups. So no email servers would be able to validate your address is legitimate and so would drop it as spam.





  • You should definitely set up a DMARC record to prevent other people from using your email domain to send spam. If you don’t have DMARC configured, other email servers will give any senders the benefit of the doubt and accept mail that claims to be from your domain.

    You can just set the DMARC record to reject 100% of unverified mail and call it a day. Since you aren’t sending anything it won’t affect you.