1

Background

When I explain to my clients the security issues around email spoofing, I often explain that emails are like regular mail. Anyone can write Jon Doe on the return address, but that doesn't necessarily mean that Jon Doe sent it.

Potential Solution?

Why can't an email server be setup to receive the following fields over a TLS session:

domain
sender
hash of email

And return True if an email was sent that fits those values.

After every email the client receives, it can reach out to that email server with those values. If the client gets a return of False, just drop the email.

Improve this question

1 Answer 1

Reset to default
1

Well, its not that easy.

Almost all SMTP servers are configured to prioritise the delivery of emails. This makes for example encryption between servers opportunistic today. Another problem is, how can you know for certain that a specific mail server is the only one allowed to send emails for a specific domain? Also a email almost always pass through many servers before reaching its destination. This is only a few of the problems we are facing.

Possible solutions

There are several solutions to this problem that are widely used at the moment. But I think the biggest problems are adoption and ease of configuration.

Here is a few:

  1. DKIM and DMARC - the server signs sent emails with a asymmetric key, where the public key is published in DNS, this way the receiving server can verify the authenticity of that email.
  2. SPF - You add DNS records that tell what servers are allowed to send emails for a specific domain. This way (if the receiving end honours it) emails from a domain will only be accepted from a defined set of servers.
  3. S/MIME - the USER signs the email with a x509-certificate from a trusted CA, this way you can be reasonably sure that the email was sent from the person you think it was.
  4. PGP signing of emails

The problem I guess is that solution 1-2 is hard to setup for administrators (and voluntary) and solution 3-4 is even harder to setup for the user.

Your solution would require new protocols implemented in the email client and would take a very long time to see widespread adoption.

Improve this answer
5
  • Also see SPF: en.wikipedia.org/wiki/Sender_Policy_Framework
    – mti2935
    Commented Nov 17, 2020 at 19:14
  • Oops, totally forgot. Will add it.
    – Peter
    Commented Nov 17, 2020 at 19:16
  • For example google require SPF records (at least for IPv6). So, if you dont use it there is a big risk that gmail will drop them.
    – Peter
    Commented Nov 17, 2020 at 19:21
  • @Peter yea, you're right, there would have to be some sort conversation between the server that is responsible for the domain and the server that sent the actual email.
    – MikeSchem
    Commented Nov 17, 2020 at 19:31
  • DKIM signatures can get broken by relays, especially mailing lists. See Authenticated Received Chain (ARC) for an attempt at resolving that (which requires trust).
    – Adam Katz
    Commented Nov 25, 2020 at 19:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .