0

I have been playing around with sending emails via telnet using text commands.

Theoretically...

Say I send an email from a typical mail agent that adds a dkim signature from a@a.com to b@b.com.

If I grab the message source (just including the headers listed in the DKIM-Signature header and the body) from b@b.com and send it as the "data" of a telnet session email from a@a.com to b@b.com, should the dkim pass? Or is there some mechanism that stops an email in dkim that stops an email from being sent twice with the same exact headers & body?

  • The DKIM spec requires signing the Date header, and while it allows for some variability, your attack would have to happen within a second or two of the original message that it replays. – Adam Katz Sep 24 at 16:03
1

In DKIM the senders MTA signs the message and some headers using a private key only known to this MTA. The signature was explicitly designed to survive redistribution of the unmodified mail. This kind of redistribution is what you are doing with telnet.

In other words: the DKIM signature is specific to the mail itself and not specific to the process of sending the mail. This is different from SPF which cares about the actual process of delivery only by checking the senders IP address against the claimed sender in the SMTP envelope but does not care about the actual content of the mail.

  • Thanks for the clear response. So it should work... unfortunately they way I'm testing is by sending to a gmail address and google drops the email (it responds with "OK" when I end the transmission, but never delivers the email -not even to spam-, even though other emails I've sent via the telnet process were delivered.) – Dedicated Managers Sep 20 at 22:16
  • @DedicatedManagers: It is not clear what you are really doing (not enough details to reproduce). But having a valid DKIM signature does not mean that the mail will magically pass any spam checks. Anyway, your question was answered and what you describe now is a different problem and thus should be asked as a new question with sufficient details. – Steffen Ullrich Sep 21 at 5:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.