5

Excuse my ignorance. I'm just a beginner trying to fill in the knowledge gaps that I have on how email system in general works, so this might seem a silly question to some or even all of you.

Is there a possibility that an email comes from an illegitimate sender despite passing spf, dkim and dmarc? I know the answer here is yes, because you can, however, forge display name and "From" address. But after looking at the raw message and analyzing the fields (let's say the return-path), you can tell that they are not what they are claiming to be. In this case you are justified that it is a spoofed email

Now, what if all the fields on the raw message of an email seem to be coming from a legitimate sender?

This begs the question, what are the conditions that, collectively, rule out that it is a spoofed email?

are these conditions sufficient?

  • passing spf, dkim and dmarc
  • all the fields on the raw message of an email seem to be coming from a legitimate sender
Improve this question

1 Answer 1

Reset to default
4

DKIM, SPF and DMARC provide some protection, but not full protection against spoofing. Specifically:

  • The combination of DKIM, SPF and DMARC only protects against spoofing of the senders domain, not the full sender email.
  • It is common that domains use third parties for some of their mail delivery, like for newsletters etc. In this case these third parties need to be included in SPF and DKIM in order for DMARC to pass. This allows these third parties to send mails arbitrary email addresses within these domains, i.e. it is not possible to limit their privileges to only selected sender addresses within the domain.
  • These technologies don't protect against takeover of mail infrastructure or mail accounts. For example if some broken script on some web server allows an attacker to send mail from within this domain, then an attacker can misuse these for spoofing.
  • DKIM is fragile and allows some spoofing - see Breaking DKIM - on Purpose and by Chance (disclaimer: my own research). This makes anything fragile which relies on it, including DMARC.
  • There are several other ways to spoof mails, which rely on broken implementations or broken configuration of these mechanisms in sender and receiver infrastructure but also how mail is displayed in clients - see Weak Links in Authentication Chains: A Large-scale Analysis of Email Sender Spoofing Attacks from Usenix Security 2021 for some good analysis.

Are these conditions sufficient?

  • passing spf, dkim and dmarc

No, see above on what limited protection these mechanism even claim to offer and how even these claims might fail in practice.

  • all the fields on the raw message of an email seem to be coming from a legitimate sender

"seem to be coming ..." is a weak statement and for a reason. There is no way to a actually prove the origin of fields in most cases. Even in the case of a valid DKIM signature most of the fields are not included in this signature and often not even all of the significant fields.

Improve this answer
3
  • What if it passed SPF, DKIM and DMARC + all raw message fields (i.e return-path, dkim signature, etc.) is associated to a legitimate sender. In this case, the only way that I think of an email being spoofed with these combined conditions is that the server has been infiltrated or the sender gains control of an email account. Or there are other ways?
    – Crito
    Commented Oct 5, 2022 at 10:37
  • 2
    @Crito: "all raw message fields (i.e return-path, dkim signature, etc.) is associated to a legitimate sender" - you cannot be sure of this unless all of these are covered by the DKIM signature, which they usually aren't. Return-Path is also set by the last MTA receiving based on what was claimed in the SMTP dialog. Received is set by hops. "In this case, the only way that I think of ..." - see above for more, i.e. different sender in same domain, misused DKIM by third party, broken DKIM, ... and what is covered in the paper I referenced.
    – Steffen Ullrich
    Commented Oct 5, 2022 at 11:09
  • Thank you! I sincerely apologize for the misunderstanding.
    – Crito
    Commented Oct 5, 2022 at 11:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .