0

SPF and DKIM helps to determine whether a sender is allowed to send a mail from a specific domain or not. Now, if X employee of Company with email X@Company.com tampers the message headers and sends mail as Y@Company.com then how does SMTP server recognizes the tampered header? Since X is listed in the SMTP DNS records being a internal employee, the SPF and DKIM will pass. I wish to know the mitigation of this problem. People have been facing this kind of issue refer to these interesting questions:

  1. Mails to internal receivers with faked sender address
  2. Issues with using a mail server that doesn't support authentication to send mail?
  • 1
    " Since X is listed in the SMTP DNS records being a internal employee, .." - you probably mean MX records. But these don't contain any information about users and no other part of DNS contains such information. DNS cares about domains only. – Steffen Ullrich Aug 18 '16 at 19:53
  • Oh, yes I meant MX records. And thanks for correcting me I wanted to say X sends mail from the smtp server with the required spf and dkim records – Vishal Aug 18 '16 at 20:13
1

how does SMTP server recognizes the tampered header?

They don't unless they require authentication. With authentication it can be determined if the authenticated user is the same as the acclaimed sender of the mail.

SPF and DKIM are not used in this case. These care only about spoofing the domain part of the senders address and do not care about single users at all. Thus they can be used to find out if mails coming in from outside spoof the domain name. But they can not be used to find out if mails from spoof the user part of the senders address.

0

I wish to know the mitigation of this problem.

Cryptographic signing of email by the sender is the only trustworthy mitigation of this problem. (Rather, determining that a sender is invalid based on their lack of cryptographic signing, when you have reason to expect it should be there, is the only trustworthy mitigation...)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.