1

Rewriting for clarity:

This is regarding emails send from a 3rd party marketer spoofing one of our email addresses in the message header from field. In these emails the envelope sender would come from "[email protected]", but the message header from field would show "[email protected]". Normally, this would be spoofing and blocked, but this is valid emails that we pay that marketing firm to send.

As I understand it:

  • SPF only validates that emails from the Envelope Sender come from specific mail hosts. It does not care what the Header Sender is (Spoofing).
  • DKIM does not care who sent the email. Just that the DKIM signature on the receiving end is the same as the one acquired on the sending side.
  • DMARC ONLY cares that the Envelope Domain (sometimes subdomain) and Header Domain (somtimes subdomain) align (Meaning they are the same).

So, as long as the Marketing Firm sends the emails from one of the sources in their SPF record, it's going to PASS SPF. I see a lot of this traffic from many of our clients and customers. We are looking for a way to validate (allow) authorized spoofing vs a legit spoofing attack (block).

Question: Is there any method for validating that while spoofed, these emails are authorized spoofing.

Improve this question
2
  • RFC 2606 standardizes TLDs in documentation. When using TLDs other than as standardized, it is more difficult for people to read and interpret what you write. The harder you make it for someone to interpret what you write, the less likely you are going to get good answers, or any answers, to your questions.
    – Paul
    Apr 20, 2022 at 12:27
  • No spoofing required, just fill out the SMTP headers (From, Sender, Return-path) properly. Mail sent on behalf of another user who authorized its transmission is a supported use-case. superuser.com/q/747633/29943
    – Ben Voigt
    May 20, 2022 at 19:16

1 Answer 1

Reset to default
0

Current standards protect domains, not specific email addresses. If your goal is to only authorize a single email address be sent by a 3rd party without also authorizing the domain, there is currently not a standard to support this.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .