Timeline for Why set up DMARC for SPF if it's already set up for DKIM?
Current License: CC BY-SA 3.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Feb 11, 2020 at 20:16 | comment | added | Steffen Ullrich | @SWdV: Since it is sufficient that either DKIM or SPF succeed a failed SPF does not actually prevent spoofing and most mail servers don't block hard on failed SPF. So unmodified replay is not actually prevented by using SPF. It can actually be prevented by having an expiration on the DKIM signature which is actually included in the standard although only recommended and not required so it is not actually used in most DKIM signatures I see. | |
| Feb 11, 2020 at 18:48 | comment | added | SWdV | OK thanks! I indeed meant MTAs. Replay is in theory still a problem though right? Although impact should be limited if you sign the Date header. | |
| Feb 11, 2020 at 18:36 | comment | added | Steffen Ullrich | @SWdV: First, SPF is not implemented in mail clients but in mail servers since it needs to know the sending servers IP address. Similar DKIM and DMARC checks are usually also implemented at mail servers although DMARC in a client might also make use of the Received-SPF header added by the mail server. And the problem are not only the systems that check DKIM but that many domains don't even have a DKIM record, i.e. it is a lot a sender side problem. But, if DKIM would have been properly implemented everywhere there would be no real benefit for SPF. | |
| Feb 11, 2020 at 18:11 | comment | added | SWdV | From my comment: So are you saying that clients that haven't implemented DKIM are the only reason to implement SPF, and there are no benefits for clients that support DKIM & DMARC? | |
| Oct 11, 2017 at 18:12 | vote | accept | Qaz | ||
| Oct 11, 2017 at 5:10 | history | edited | Steffen Ullrich | CC BY-SA 3.0 |
added 28 characters in body
|
| Oct 11, 2017 at 5:02 | history | answered | Steffen Ullrich | CC BY-SA 3.0 |