I just received an email that seemingly comes from Microsoft (invites@microsoft.com). Apart from asking Microsoft, is there a way to properly authenticate an email's origin with public key etc? (Especially from a company like MS or google?)

I just finished an Crypto intro course and am just curious about this in general.


Yes, but all the reliable methods are optional:

  • PGP signing (also depends on you already having a large PGP network or directly having accepted the real senders public key)

  • x509 signing (S/MIME) - which few people use, despite relatively painless setup on the signing side

  • DMARC - which probably isn't supported in your mail user agent but is gaining wide adoption in MTAs.

  • Sender Policy Framework - again is probably ignored by your user agent but commonly implemented in MTAs - Not as robust as the methods above which use cryptographic signatures.

A further issue with all of these technologies is that they are designed as means for computers to validate the identity of other computers rather than as a way of proving to human beings that an email is genuine.

  • Thanks for the answer! I was under the impression that common email protocol has some "bread crumbs" that lead back to the where it came from with some crypto magic. I will look into the DMARC, sounds interesting. – pip Nov 19 '17 at 3:23
  • 1
    You can see the chain of "received-from" headers - but this is trivial to forge – symcbean Nov 19 '17 at 18:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.