1

I understand there are techniques to prevent someone from spoofing your domain in emails.

Is there any guarantee or check that the receiver can do to ensure the sender is authentic?

Gmail shows TLS and signature information, is that sufficient to guarantee the authenticity of the sender when present?

0
2

Message authentication methods such as SPF, DKIM, and DMARC can be used by a message recipient to determine whether the domain of the apparent sender may have been spoofed. These standards are based on information published in the DNS for the sender’s domain.

In the case of SPF, an SPF record is published in the DNS for a domain to specify the SMTP servers that are authorized to send mail from senders in that domain. If a spoofer tries to send a message appearing to be from *@paypal.com, he is unlikely to be able to relay the message through one of the SMTP servers designated in the SPF record for paypal.com. If he tries to send the message through a SMTP server other than one that is designated in the SPF record for paypal.com, the recipient’s spam filter would likely detect this mismatch and determine that there is a high likelihood that this message was spoofed. As pointed out in the comments by @SteffenUllrich, the shortcoming of SPF is that it only applies to the domain of the sender address in the MAIL FROM of the message envelope, which is generally not seen by the recipient. However, DMARC can be used in conjunction with SPF to apply to the sender address in the message headers as well.

In the case of DKIM, a DKIM record containing a public key is published in the DNS of the domain. A signature over a hash derived from the message body and headers is created using the private key corresponding to that public key, and this signature is included in the headers of the message. If a spoofer attempts to send a message appearing to be from *@paypal.com, he would not have the private key, and therefore would not be able to create a valid signature. Therefore, if the recipient’s spam filter is able to verify the signature using the DKIM public key published in the DNS of the purported sender’s domain, then it’s unlikely that the message was spoofed.

As pointed out by @SteffenUllrich, all of the above frameworks validate the sender’s domain, but not the particular sender. In addition to (or instead of) these frameworks, the sender can sign the message using an S/MIME or PGP/GPG signature. If the recipient has the sender's public signing key, then the recipient can use the public key to verify the signature. If the signature verifies, then this proves that the sender (or someone else that has the sender's private key) signed the message.

8
  • There are also certain services such as ProtonMail and Tutanota that provide end-to-end encrypted emails, which allow for you the validate the sender and receiver.
    – RocketSEA
    Jun 17 '20 at 18:49
  • When you say "the recipient has the sender's public signing key", I presume you mean the provider. So if gmail shows you "signed-by: x", that means that gmail has verified the signature with its own public key storage, therefore I can be sure that whoever sent the email has the private key for that domain so it's likely to be who they say they are? Jun 18 '20 at 7:25
  • SPF by itself is practically useless to detect spoofing since it cares only about the SMTP envelope which is not even shown. DKIM can be useful if the signing domain matches the visible sender domain - but even DKIM is not foolproof. The "signature information" the OP asks about mean DKIM and have nothing to do with S/MIME or PGP. Jun 18 '20 at 7:39
  • @SteffenUllrich, Thanks for your comments. I agree that SPF alone is not of much use. But, in combination with DMARC, it can be used to prevent forging of the sender in the message headers as well as the envelope sender. I edited my answer to include this point. I mentioned S/MIME and GPG/PGP because one of OP's questions is, 'Is there any guarantee or check that the receiver can do to ensure the sender is authentic?'. As you know, this is exactly what S/MIME and PGP signatures are for.
    – mti2935
    Jun 18 '20 at 18:37
  • 1
    @Stefanod'Antonio, The signed-by header that Gmail adds to message headers of messages sent through gmail is for DKIM. This header shows a domain name. You can do a DNS query of this domain name to find the public key corresponding with the private key that was used to sign the message. Then, you can use this public key to verify the DKIM signature.
    – mti2935
    Jun 18 '20 at 18:48
0

Gmail shows TLS and signature information, is that sufficient to guarantee the authenticity of the sender when present?

No. TLS does not provide any protection against sender spoofing at all.

The "signed-by" in the interface you refer to is about DKIM signatures. If the domain shown there aligns with the domain you see as sender for the mail, then you can be kind of sure that the domain was not spoofed - although this is not foolproof either. And this makes only a statement about the senders domain, not about the full address.

And if the domains don't align you cannot be sure that the domain was spoofed either. It is pretty common to have DKIM signatures which don't align with the senders domain.

2
  • Gmail's web UI shows: signed-by, so I presume the sender must have a private key to encrypt/sign the email and gmail must somehow verify that against a public key. Are you aware of any UI feedback (if any) about DMARC in gmail? Jun 18 '20 at 7:29
  • 1
    @Stefanod'Antonio: "signed-by" is just DKIM signature. If this domain aligns with what you see as sender it gives some spoofing protection, otherwise it is useless. Jun 18 '20 at 7:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.