1
Trusted Sender does not work
Idea shared by J Lee - 7/19/2023 at 11:11 AM
Proposed
So, if you have noticed that sometimes Trusting a Sender does not put that sender's email in the inbox, the reason is below. There is nothing in SM to let you know this is happening. 

\\Proposed Solution\\ I believe this is overprotection. If the end user takes the action to "Trust" the sender's email address, it should override the NO Dmarc response. I also believe SM should not override if Dmarc is in place and it fails, but many legitimate domains do not use Dmarc.
 
\\Reason\\Thank you for reaching out. In newer builds of SmarterMail, we evaluate the DMARC result of an incoming email in order to determine if the From Address can be verified as a trusted sender. If DMARC does not pass, I'm afraid the From Address cannot be used to verify the trusted sender status, and the full spam weight of the email will be applied. 
 
This change was made because DMARC is the only check available that can confirm that the From Address listed in the email is associated to the SPF record available. This check ensures that the From Address cannot be spoofed, then automatically trusted just because the From Address is listed as a trusted sender. 
 
In the example you provided, this email had the full spam weight applied because there is no DMARC record available. To correct this issue with the email not being verified as a trusted sender, DMARC must be added by the sender. 

J. Sebastian Lee Service2Client LLC 6333 E Mockingbird Ste 147 Dallas, TX 75214 - 877.251.3273

3 Replies

Reply to Thread
1
Kyle Kerst Replied
Employee Post
I disagree that marking an address as Trusted Sender should override DMARC and the like as this would open the user up to spoofed messages from those addresses. Granted, so long as you tell your users that these eventualities are their responsibility; you should be okay!
Kyle Kerst System/Network Administrator SmarterTools Inc. (877) 357-6278 www.smartertools.com
0
>>>>>
I disagree that marking an address as Trusted Sender should override DMARC and the like as this would open the user up to spoofed messages from those addresses. 
>>>>>

Hi Kyle

Ideally, this option can be configured per domain. 




0

This study states that in 2019, 80% of all email systems do not use Dmarc. 

To be clear, we use Dmarc, which is excellent. I do not understand why all email systems do not use it. 

Also, to be clear, all emails that fail Dmarc when Dmard is present, or any virus scans should never be delivered to your inbox. 

I am only concerned with the "Trusted Sender" function. It does not handle No Dmarc record well. 


There is also a difference between how SM defines a Trusted Sender and how an end user defines a Trusted Sender. There is a disconnect here. 

I think there is a cleaner way to handle this specific issue. Users do not understand why Trust Sender still sends some emails to Junk. So, I created this post so postmasters could add their ideas and hopefully help develop a better function. 

Ideas:

Append the subject with Warning Message Failed Dmarc.

or 

Have two options for our email clients. 

a. Approve Sender - but process all spam scans 
b. Trust Sender - this could auto-create a filter to move the email to the inbox. You could also have a check box before creating that says, I understand the risks of Trusting Sender.
J. Sebastian Lee Service2Client LLC 6333 E Mockingbird Ste 147 Dallas, TX 75214 - 877.251.3273

Reply to Thread