0

In a small company, we have an issue suspecting a former employee has forged an e-mail to our company from his Hotmail account by changing its date and recipients in the EML file, claiming that the recipients were aware of the content by the date that he is showing. However, we have never seen that email.

We may request a copy of the e-mail from his sent folder. And there are two outcomes, either he is a forger, or we had a glitch, which prevented the email delivery to our addresses.

Details:

Normally, emails we receive in our Outlook are signed between servers with ARC seals and DKIM signatures. Can we use that?

I am not sure how to use it for checking the authenticity "offline", or is it possible for emails from the Hotmail sent-box.

1 Answer 1

2

If the sender sent the message through Hotmail's outgoing mail service, then Hotmail would have signed the message (including all headers) using its DKIM private key. This signature can be verified using Hotmail's DKIM public key, which is published in Hotmail's DNS.

Thus, even though DKIM was not intended for this purpose, the DKIM signature can be used as a way of timestamping a message. By verifying the DKIM signature on a message, this can be used to prove (with Hotmail as a 'witness'), that the message was in fact sent through Hotmail, and sent at a particular time.

See https://blog.cryptographyengineering.com/2020/11/16/ok-google-please-publish-your-dkim-secret-keys/ for more info.

5
  • 2
    How does one perform that verification?
    – schroeder
    Commented Dec 26, 2023 at 13:50
  • 1
    @schroeder good question. See github.com/robertdavidgraham/hunter-dkim for an interesting github project for performing this verification.
    – mti2935
    Commented Dec 26, 2023 at 14:37
  • 1
    Are you talking about received message, or downloaded from Hotmail "Sent" folder? If the downloaded message does not contain the DKIM sign, is there a way to retrieve the "Sent" message from the user account with the digital sign?
    – Asdf
    Commented Dec 27, 2023 at 15:48
  • 2
    @Asdf I don't have a Hotmail account to test this. But, if Hotmall DKIM-signs outgoing messages, then stores the DKIM-signed messages in the 'sent messages' folder - then a sender can prove he sent a message at a certain time by fetching the DKIM-signed message from the 'sent messages' folder, and showing the DKIM-signed message and that the signature verifies.
    – mti2935
    Commented Dec 27, 2023 at 20:48
  • 1
    thank you. probably I should try to register an address there and see
    – Asdf
    Commented Dec 28, 2023 at 15:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .