SPF and DKIM helps to determine whether a sender is allowed to send a mail from a specific domain or not. Now, if X employee of Company with email [email protected] tampers the message headers and sends mail as [email protected] then how does SMTP server recognizes the tampered header? Since X is listed in the SMTP DNS records being a internal employee, the SPF and DKIM will pass. I wish to know the mitigation of this problem. People have been facing this kind of issue refer to these interesting questions:
-
1" Since X is listed in the SMTP DNS records being a internal employee, .." - you probably mean MX records. But these don't contain any information about users and no other part of DNS contains such information. DNS cares about domains only.– Steffen UllrichCommented Aug 18, 2016 at 19:53
-
Oh, yes I meant MX records. And thanks for correcting me I wanted to say X sends mail from the smtp server with the required spf and dkim records– VishalCommented Aug 18, 2016 at 20:13
Add a comment
|
2 Answers
how does SMTP server recognizes the tampered header?
They don't unless they require authentication. With authentication it can be determined if the authenticated user is the same as the acclaimed sender of the mail.
SPF and DKIM are not used in this case. These care only about spoofing the domain part of the senders address and do not care about single users at all. Thus they can be used to find out if mails coming in from outside spoof the domain name. But they can not be used to find out if mails from spoof the user part of the senders address.
answered Aug 18, 2016 at 19:56
I wish to know the mitigation of this problem.
Cryptographic signing of email by the sender is the only trustworthy mitigation of this problem. (Rather, determining that a sender is invalid based on their lack of cryptographic signing, when you have reason to expect it should be there, is the only trustworthy mitigation...)
answered Aug 18, 2016 at 20:01
