SPF and DKIM helps to determine whether a sender is allowed to send a mail from a specific domain or not. Now, if X employee of Company with email X@Company.com tampers the message headers and sends mail as Y@Company.com then how does SMTP server recognizes the tampered header? Since X is listed in the SMTP DNS records being a internal employee, the SPF and DKIM will pass. I wish to know the mitigation of this problem. People have been facing this kind of issue refer to these interesting questions:
1" Since X is listed in the SMTP DNS records being a internal employee, .." - you probably mean MX records. But these don't contain any information about users and no other part of DNS contains such information. DNS cares about domains only.– Steffen UllrichAug 18, 2016 at 19:53
Oh, yes I meant MX records. And thanks for correcting me I wanted to say X sends mail from the smtp server with the required spf and dkim records– VishalAug 18, 2016 at 20:13
how does SMTP server recognizes the tampered header?
They don't unless they require authentication. With authentication it can be determined if the authenticated user is the same as the acclaimed sender of the mail.
SPF and DKIM are not used in this case. These care only about spoofing the domain part of the senders address and do not care about single users at all. Thus they can be used to find out if mails coming in from outside spoof the domain name. But they can not be used to find out if mails from spoof the user part of the senders address.
I wish to know the mitigation of this problem.
Cryptographic signing of email by the sender is the only trustworthy mitigation of this problem. (Rather, determining that a sender is invalid based on their lack of cryptographic signing, when you have reason to expect it should be there, is the only trustworthy mitigation...)