But it doesn't protect many older customers not using Workers, some of which are very high profile.

J

JamesOP•8/12/23, 7:19 PM

Yep. But over 2M of their customers don't, it's not something they enforce, and they make it very easy to do since all customers use the same relay.

J

JamesOP•8/12/23, 7:19 PM

This was a recent talk at defcon. Further reading if anyone is interested: https://media.defcon.org/DEF%20CON%2031/DEF%20CON%2031%20presentations/byt3bl33d3r%20-%20SpamChannel%20Spoofing%20Emails%20From%202%20Million%20Domains%20and%20Virtually%20Becoming%20Satan.pdf

JJames But it doesn't protect many older customers not using Workers, some of which are...

H

Hello, I’m Allie!•8/12/23, 7:30 PM

Wasn’t there also a thing about how because they have ARC enabled then it can bypass SPF/DKIM checks even if you aren’t a MailChannels customer?

H

Hello, I’m Allie!•8/12/23, 7:30 PM

So basically any domain comes through as green

J

JamesOP•8/12/23, 7:33 PM

Something like that, yeah. I don't know the intricacies of ARC well enough to talk on that, but yeah, my opinion is to simply not use MailChannels personally.

J

JamesOP•8/12/23, 7:33 PM

Hopefully they act quickly here and lock down their platform more.

HHello, I’m Allie!Wasn’t there also a thing about how because they have ARC enabled then it can by...

C

Chaika•8/12/23, 7:37 PM

rereading the slides, it looks like ARC is just another signal, some email providers use for spam score

C

Chaika•8/12/23, 7:37 PM

the example they gave was a domain with no spf/dkim records at all was able to be spoofed with an email that went to inbox, and passing arc added a point to not spam score

S

Sam•8/12/23, 8:30 PM

Thank you all for this discussion. So I think I'll stick with Postmark for now. The Workers function to trigger emails through Postmark should be pretty reliable, right? It's not like Workers often "drop" executions when they're called?

Z

zegevlier•8/12/23, 8:35 PM

For normal workers it's not garunteed (stuff like sudden hardware failures happen), but it's very unlikely. If you want to be more certain it'll get sent, you can use durable object alarms.

D

Dubz•8/13/23, 10:49 AM

trying to use VNC web app but can't seem to get it up on Windows. Does it require a certain server software, or does it even work with Windows?

D

Dubz•8/13/23, 11:11 AM

Never mind. I did some testing finally and realized even though I unticked the "Use" box next to the encryption plugin, it was still using it and thus couldn't connect. Had to tick/untick it again and manually delete the filename from the dropdown field and now it works.

D

Dubz•8/13/23, 11:17 AM

I guess follow up question now. Is there a way to get a better resolution set up? lol

!

!_r3c4•8/13/23, 3:17 PM

Hi,
Is there any advanced here who can set firewall rules, my setting is fine but there are still bypasses.
I can pay for the service. Send PM

S

SAMkenX•8/13/23, 4:57 PM

It works all the time ..even offline.

C

Caio Pinna•8/13/23, 7:56 PM

Hi, guys! I'm on a Enterprise account but not able to use Cloudflare images :/

C

Caio Pinna•8/13/23, 7:56 PM

Error: Subscription IMAGES_ENT_TRYOUT colliding with active subscription STREAM_ENT (Code: 1226)

CCaio Pinna Error: Subscription IMAGES_ENT_TRYOUT colliding with active subscription STREAM_...

J

JamesOP•8/13/23, 7:57 PM

Hey, that's unfortunately a common issue with Images/Stream product rateplans. Your best bet is to submit a support ticket or reach out to your CSM to get this resolved, sorry

J

JrMasterModelBuilder•8/13/23, 9:00 PM

Does anyone know the correct DNS records to create for say

noreply.example.com

noreply.example.com

noreply.example.com

noreply.example.com ?

With just this I can send emails:

TXT

TXT

TXT

TXT

_mailchannels.noreply

_mailchannels.noreply

_mailchannels.noreply

_mailchannels.noreply

v=mc1 cfid=myid.workers.dev

v=mc1 cfid=myid.workers.dev

v=mc1 cfid=myid.workers.dev

v=mc1 cfid=myid.workers.dev

However, this seem problematic:

TXT

TXT

TXT

TXT

noreply

noreply

noreply

noreply

v=spf1 include:relay.mailchannels.net ~all

v=spf1 include:relay.mailchannels.net ~all

v=spf1 include:relay.mailchannels.net ~all

v=spf1 include:relay.mailchannels.net ~all
As does this:

TXT

TXT

TXT

TXT

noreply

noreply

noreply

noreply

v=spf1 a mx include:relay.mailchannels.net ~all

v=spf1 a mx include:relay.mailchannels.net ~all

v=spf1 a mx include:relay.mailchannels.net ~all

v=spf1 a mx include:relay.mailchannels.net ~all

With those records, I start getting this error message from the send API:

Failed to send email: 550 5.1.2 [SDNF] Sender Domain Not Found...

JJrMasterModelBuilder Does anyone know the correct DNS records to create for say `noreply.example.com`...

E

Erisa•8/13/23, 9:11 PM

Is the Worker running on a custom domain/route or on the default

workers.dev

workers.dev

domain?

EErisa Is the Worker running on a custom domain/route or on the default `workers.dev` d...

J

JrMasterModelBuilder•8/13/23, 9:12 PM

The default

workers.dev

workers.dev

.

E

Erisa•8/13/23, 9:12 PM

I see. Unsure then

U

Unsmart•8/13/23, 9:15 PM

Whats your code for email sending?

setting the spf record should have no effect on the sender domain check that mail channels does

J

JrMasterModelBuilder•8/13/23, 9:17 PM

    const result = await fetch("https://api.mailchannels.net/tx/v1/send", {
      method: "POST",
      headers: {
        "Content-Type": "application/json"
      },
      body: JSON.stringify({
        personalizations: [
          {
            to: [
              {
                email: env.CONTACTED_EMAIL,
                name: env.CONTACTED_NAME
              }
            ]
          }
        ],
        from: {
          email: env.SENDING_EMAIL,
          name: env.SENDING_NAME
        },
        reply_to: {
          email,
          name
        },
        subject: env.CONTACTED_SUBJECT,
        content: [
          {
            type: "text/plain",
            value: message
          }
        ]
      })
    });
    if (result.status !== 202) {
      console.error(`${result.status}: ${await result.text()}`);
      return errorResponse(500);
    }

    const result = await fetch("https://api.mailchannels.net/tx/v1/send", {
      method: "POST",
      headers: {
        "Content-Type": "application/json"
      },
      body: JSON.stringify({
        personalizations: [
          {
            to: [
              {
                email: env.CONTACTED_EMAIL,
                name: env.CONTACTED_NAME
              }
            ]
          }
        ],
        from: {
          email: env.SENDING_EMAIL,
          name: env.SENDING_NAME
        },
        reply_to: {
          email,
          name
        },
        subject: env.CONTACTED_SUBJECT,
        content: [
          {
            type: "text/plain",
            value: message
          }
        ]
      })
    });
    if (result.status !== 202) {
      console.error(`${result.status}: ${await result.text()}`);
      return errorResponse(500);
    }

    const result = await fetch("https://api.mailchannels.net/tx/v1/send", {
      method: "POST",
      headers: {
        "Content-Type": "application/json"
      },
      body: JSON.stringify({
        personalizations: [
          {
            to: [
              {
                email: env.CONTACTED_EMAIL,
                name: env.CONTACTED_NAME
              }
            ]
          }
        ],
        from: {
          email: env.SENDING_EMAIL,
          name: env.SENDING_NAME
        },
        reply_to: {
          email,
          name
        },
        subject: env.CONTACTED_SUBJECT,
        content: [
          {
            type: "text/plain",
            value: message
          }
        ]
      })
    });
    if (result.status !== 202) {
      console.error(`${result.status}: ${await result.text()}`);
      return errorResponse(500);
    }

    const result = await fetch("https://api.mailchannels.net/tx/v1/send", {
      method: "POST",
      headers: {
        "Content-Type": "application/json"
      },
      body: JSON.stringify({
        personalizations: [
          {
            to: [
              {
                email: env.CONTACTED_EMAIL,
                name: env.CONTACTED_NAME
              }
            ]
          }
        ],
        from: {
          email: env.SENDING_EMAIL,
          name: env.SENDING_NAME
        },
        reply_to: {
          email,
          name
        },
        subject: env.CONTACTED_SUBJECT,
        content: [
          {
            type: "text/plain",
            value: message
          }
        ]
      })
    });
    if (result.status !== 202) {
      console.error(`${result.status}: ${await result.text()}`);
      return errorResponse(500);
    }

SENDING_EMAIL=noreply@noreply.example.com

SENDING_EMAIL=noreply@noreply.example.com

SENDING_EMAIL=noreply@noreply.example.com

SENDING_EMAIL=noreply@noreply.example.com

U

Unsmart•8/13/23, 9:19 PM

https://support.mailchannels.com/hc/en-us/articles/203155500-550-5-2-1-SDNF-Sender-Domain-Not-Found this is what mailchannels says about that error code

Help Center

550 5.2.1 [SDNF] Sender Domain Not Found

The "550 5.2.1 [SDNF] Sender Domain Not Found" error message indicates that our server was unable to verify the existence of a sender's email domain - in other words, the part of the email address ...

U

Unsmart•8/13/23, 9:20 PM

fwiw though if you are sending emails from yourself to yourself which it seems you are you can use this: https://developers.cloudflare.com/email-routing/email-workers/send-email-workers/

Send emails from Workers (beta) · Cloudflare Email Routing docs

You can send an email about your Worker’s activity from your Worker to an email address verified on Email Routing. This is useful for when you want to …

UUnsmart fwiw though if you are sending emails from yourself to yourself which it seems y...

J

JrMasterModelBuilder•8/13/23, 9:21 PM

Oh, that's interesting. Maybe I'll switch over to that later.

J

JrMasterModelBuilder•8/13/23, 9:22 PM

There's a vague thread over here I found with someone having possibly the same error, suggesting they also need MX records. Does that sense?
https://community.cloudflare.com/t/sdnf-sender-domain-not-found/446190

U

Unsmart•8/13/23, 9:23 PM

It looks like yeah the support thing I linked seems to suggest the email you send from must be able to receive even if you dont read it. Not sure if theres fake mx records you can put to just null route them or not

J

JamesOP•8/13/23, 9:24 PM

Not directly solving your problem, but I would recommend avoiding MailChannels and using what Unsmart linked, or some other service like Amazon SES, Sendgrid, Postmark, etc.

There are a lot of security implications and their responses to the whole ordeal have been very undesirable. Further reading:

J

JrMasterModelBuilder•8/13/23, 9:25 PM

Yeah, I figured there was a potential for abuse, which is why I put off trying to create an spf record until a way of locking down the sender was introduced.

UUnsmart It looks like yeah the support thing I linked seems to suggest the email you sen...

E

Erisa•8/13/23, 9:26 PM

A null MX record is surprisingly a thing! You just enter

for the server

C

chientrm.com•8/14/23, 1:42 AM

When I look into Account Analytics, there's hundred thousands requests.
But when I look into individual worker analysis, page views and visits = 0

JJames Not directly solving your problem, but I would recommend avoiding MailChannels a...

J

JustinNoel•8/14/23, 3:38 AM

Zoho's ZeptoMail is also a great choice. It's what I use.

S

sathoro•8/14/23, 8:16 AM

Postmark has amazing deliverability and I'll never use anything else. I even pay extra for our marketing software to route emails through Postmark

Original message was deleted

S

sathoro•8/14/23, 11:38 AM

they were cached requests, so no

J

JamesOP•8/14/23, 2:18 PM

I’d recommend following https://community.cloudflare.com/t/community-tip-fixing-error-524-a-timeout-occurred/42342.

J

JamesOP•8/14/23, 2:18 PM

But realistically, the solution here is really going to be to fix/improve your origin server to respond faster.

J

JamesOP•8/14/23, 2:19 PM

The max timeout of 100 seconds? You could probably get it increased with an enterprise agreement, but that’s about it as far as I know

But it doesn't protect many older customers not using Workers, some of which are very high profile.

Similar Threads

Similar Threads

Similar Threads