Timeline for Can you rule out the possibility that an email is spoofed despite passing SPF, DKIM, and DMARC?
Current License: CC BY-SA 4.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 5, 2022 at 22:53 | vote | accept | Crito | ||
| Oct 5, 2022 at 11:29 | comment | added | Crito | Thank you! I sincerely apologize for the misunderstanding. | |
| Oct 5, 2022 at 11:09 | comment | added | Steffen Ullrich | @Crito: "all raw message fields (i.e return-path, dkim signature, etc.) is associated to a legitimate sender" - you cannot be sure of this unless all of these are covered by the DKIM signature, which they usually aren't. Return-Path is also set by the last MTA receiving based on what was claimed in the SMTP dialog. Received is set by hops. "In this case, the only way that I think of ..." - see above for more, i.e. different sender in same domain, misused DKIM by third party, broken DKIM, ... and what is covered in the paper I referenced. | |
| Oct 5, 2022 at 10:37 | comment | added | Crito | What if it passed SPF, DKIM and DMARC + all raw message fields (i.e return-path, dkim signature, etc.) is associated to a legitimate sender. In this case, the only way that I think of an email being spoofed with these combined conditions is that the server has been infiltrated or the sender gains control of an email account. Or there are other ways? | |
| Oct 5, 2022 at 1:23 | history | edited | Steffen Ullrich | CC BY-SA 4.0 |
added 78 characters in body
|
| Oct 5, 2022 at 0:56 | history | edited | Steffen Ullrich | CC BY-SA 4.0 |
deleted 3 characters in body
|
| Oct 5, 2022 at 0:50 | history | answered | Steffen Ullrich | CC BY-SA 4.0 |