The security of sending emails with SPF/DKIM, but not signed

Question

We're using an email sending service (fairly known) to send our emails. We made DNS changes so that emails going through them would pass SPF and DKIM.

A few days ago we noticed that they allow any account with them to send emails on behalf of domains that do not belong to that account. For example, let's say my domain is mycompany.com, and now I want to add mycompetitor.com to my account. This service would now allow me to send emails from @mycompetitor.com.

I brought this up with them and their solution was to no longer "sign" the email, but still allow me to add whatever domain I want. So now I can still send from @mycompetitor.com except that Gmail, for example, would show "via email-sending-service.com". SPF and DKIM would still pass, and the email is not marked as spam.

So, am I being paranoid? I feel that using this email service it would allow anybody with an account to send emails that sort of look like they come from us.

They argue that this is "standard practice" and that anybody with a box somewhere could do the same. But, would SPF/DKIM still pass in those cases?

I feel that by making DNS changes I authorize this email sending company to send emails on my behalf, and then the company goes ahead and allows anybody with an account to send on my behalf (without the signing part); am I off?

Thanks

Answer 1

SPF on your domain is not about preventing you from sending forged emails; it is about preventing other people from sending emails with your domain. To be more precise, if you own domain foo.com, you can document in SPF that "every email which purports to come from an @foo.com address should exit from machine smtp.foo.com and none other". Email servers who receive an email with an alleged sender with an @foo.com address may then lookup the SPF records and check whether the email seems to come from the legitimate server (yours) or some other.

SPF processing is not mandatory so it is up to each email server to enforce it, at their leisure.

The SPF records on your domain (foo.com) will not prevent you from sending an email with a fake address, e.g. an address ending with @bar.com. In that case, it would be the SPF records on the bar.com domain which matter.

DKIM has a somewhat similar goal. When your server uses DKIM, then it signs every email that goes through it. The DNS for your domain documents that fact, and publishes the public key (the one used to verify the signature). Supposedly, when an email server receives an email with an @foo.com sender, that server will see your DKIM key in the DNS, and thus verify the signature. If the signature is absent or does not correspond to the mail contents, then the receiving email server will know that something is amiss.

There again, DKIM processing is up to each email server. And, there again, nothing in your domain will prevent you from sending emails with @bar.com as alleged sender -- but if the bar.com owner uses DKIM himself, your forgery will be revealed.

Summary: the DNS rules related to SPF and DKIM, added to the domain foo.com, document how an email should normally be sent/signed when it pretends to be sent by someone with an @foo.com address. The DNS rules in foo.com tell nothing whatsoever about emails which claim to originate from another domain.