3

This blog post from 2016 shockingly implies that gmail will accept an email if either SPF or DKIM passes. We use G suite SMTP servers, therefore SPF provides almost zero protection from spoofing. Is this still the case?

Since DMARC only needs one policy to succeed, would implementing DMARC with SPF+DKIM guarantee the security issue?

1
  • for succinctness: the answer is yes
    – Morrison
    Oct 29, 2021 at 18:36

1 Answer 1

3

That article mentions a new "security warning" in which:

On the web or Android, if you receive a message that can’t be authenticated with either Sender Policy Framework (SPF) or DKIM, you’ll see a question mark in place of the sender’s profile photo, corporate logo, or avatar.

screen shot of link in question

This has nothing to do with accepting a message for delivery. All it means is that, when neither DKIM nor SPF pass (presumably with alignment), the image used to represent the sender will be replaced by that gray stop-sign with a bold red question mark on it, as demonstrated in the screen shot.

This was an early attempt at something like BIMI (though in the other direction; this is an image to warn of potential spoofing rather than an image that is robust against spoofing) and I think it's a good protective step.

As of 2016, Google and many others block mail when DMARC invokes its reject policy, so this only affects senders that do not use DMARC p=reject (which can only trigger when neither SPF nor DKIM passes with alignment).

Back before DMARC, SPF was widely deployed and its use of -all and ~all had very low efficacy; blocking based on either would result in blocking vast volumes of legitimate mail. The SpamAssassin community even concluded that ~all (soft fail) was a stronger spam indicator than -all (hard fail)!

Without DMARC, senders don't see when their mail fails to properly verify with DKIM or SPF (barring RFC 6652, which I've never seen used). They therefore cannot determine if their failure condition (spf -all) works (and DKIM doesn't a failure condition) and neither has a suggested failure policy. DMARC provides the reporting mechanism to determine what issues may arise with a blocking policy and then lets senders issue such a policy.

If you want to require DKIM, I suggest an SPF record of v=spf1 ?all so that SPF can never pass (nor can it ever fail). Then your DMARC p=reject can deny any mail purportedly from your domain unless it passes DKIM. At that point, SPF isn't necessary (DKIM is really hard to replay and basically impossible to forge).

3
  • I consider showing a "gray stop-sign with a bold red question mark on it" to be non-acceptance. So spoofing was what I was referring to in my question.
    – Morrison
    Oct 7, 2020 at 0:45
  • When I hear "acceptance", I'm thinking "delivery". Messages that fail both SPF and DKIM either fail DMARC and are blocked by p=reject or else are given these warning icons. Either SPF or DKIM will prevent both DMARC rejection and this warning icon.
    – Adam Katz
    Oct 7, 2020 at 14:34
  • I have updated my answer to better relate how necessary DMARC reporting is to setting a usable rejection policy. If GMail sees a DMARC p=reject, the message will not be delivered. That is strong security.
    – Adam Katz
    Oct 7, 2020 at 14:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.