Sending mail to people who didn’t ask for it is often just asking for trouble. Having people give you permission to send to them is much better. In an ideal world you want first-party consent meaning that people directly subscribed to your list. You have measures in place to confirm that they really did sign up and someone didn’t just stuff their address into a subscription form. These people want your emails. ...
Many senders have concerns about sending bulk email with PDF attachments. ESPs often advise customers against doing so and suggest alternate solutions like linking to a web portal that has the PDF file. This is all very sensible. But what happens if you must send an PDF attachment due to a regulatory or some other mandatory requirement - is the campaign guaranteed to fail? The answer is no. It is possible to send a PDF attachment as part of a bulk campaign and give it a very good chance of reaching inboxes. ...
I mentioned in a previous post that DKIM and SPF have known vulnerabilities. SPF has two that are currently being exploited. The first one exploits over-broad include mechanisms and what constitutes SPF being considered to pass. For example if the SPF record for domain.victim looked like this: v=spf1 +include:_spf.google.com +include:hosting.provider ~all If you can control an IP within the range covered by hosting.provider then you can do something like this: SMTP HELO/EHLO address: kflynn@domain.hacker ...
I mentioned in a previous post that DKIM and SPF have known vulnerabilities. The main weakness with DKIM is that you can replay the messages. By design DKIM signed messages are replay-able meaning that under certain conditions you can send a DKIM signed message from A to B then B can replay the unmodified messages to C (or any number of recipients) and the signature will still validate. This works because DKIM does not sign the return-path message header or concern itself with message delivery at all. After all DKIM was always about content signing. ...