0

I've read a good bit about DMARC, DKIM, and SPF but now that I'm getting results come in, there are some things I'm seeing that I don't understand. I keep seeing passing DKIM results from outside domains and their selectors, as well as passing from the intentional domain, in a relaxed DKIM policy for DMARC. For example, a good passing result would be from something legit like this from the dundermifflin.com company:

d=dundermifflin.com
s=legitselector1
RFC5321.MailFrom = [email protected]
RFC5322.From = [email protected]

I can understand that this one passes because the selector at the legit mail server signed it properly. And since the DKIM signature points to this domain and selector, it can decrypt the hashes properly.

But I'm also seeing stuff like this that pass:

d=cheapspoofdomain.com
s=cheapselector1
RFC5321.MailFrom = [email protected]
RFC5322.From = [email protected]

Can anybody can just send a message from their own servers and use their own working selectors to hash messages and as long as DMARC is either not enabled or specifies relaxed DKIM?

2 Answers 2

0

DKIM only says that the mail has passed through the MTA for the domain specified in the DKIM signature. It says nothing about alignment of the domain in the DKIM signature with the RFC5322.From. It is actually not unusual to have multiple DKIM signatures in a mail with different domains, since the mail passed through all these MTA.

Alignment with RFC5322.From is only enforced by DMARC. And a non-aligned DKIM signature does not matter for DMARC if the SPF is aligned, since only one of DKIM and SPF needs to be valid and aligned.

3
  • Thanks for the info. WIthout a DMARC policy in place, is there any reason for DKIM? Or are these two pieces of technology meant to be used together?
    – mirkaim
    Jan 13 at 23:52
  • @mirkaim: if you care about sender spoofing than DKIM w/o DMARC does not help much. Jan 14 at 6:06
  • The more I read, the more I have come to that conclusion. Thanks.
    – mirkaim
    Jan 14 at 18:42
0

Any domain can be configured with its own SPF, DKIM, and DMARC.

Think of SPF as an allow list: it specifies all IPs that are allowed to send for the domain as specified by RFC 5321 mail from or HELO/EHLO commands.

Think of DKIM as an ID card: it actually verifies messages are documented (signed) by the domain as specified by the RFC 5322 DKIM-Signature's d=example.com; tag.

Think of DMARC as a club's bouncer: it ties these to the RFC 5322 From header domain with alignment. This ensures the SPF or DKIM passes for the sender visible to the recipient. The bouncer verifies that the SPF ("on the list") or DKIM (ID) were issued by the approved authority.

That cheapsoofdomain.com example may pass its own DKIM and SPF but it can't pass your DMARC due to not being aligned. This is why it's so important to use DMARC.

(Side note: DMARC only protects the domain in the From header's address. An attacker could set their own domain up with SPF, DKIM, and DMARC and specify your domain in the From header's display name like From: "[email protected]" <[email protected]>)

Can anybody can just send a message from their own servers and use their own working selectors to hash messages and as long as DMARC is either not enabled or specifies relaxed DKIM?

Yes. They can send a message with valid SPF and DKIM while spoofing your domain unless your domain's DMARC specifies p=reject. They can send a message with valid SPF, DKIM, and DMARC but only for their own domain.

4
  • "That cheapsoofdomain.com example may pass its own DKIM and SPF but it can't pass your DMARC due to not being aligned. This is why it's so important to use DMARC." This is where I'm getting confused by the results I'm seeing. I am using p=none so that I can monitor before I go to quarantine or reject. Also using relaxed dkim/spf default. Am I leaving a hole for DKIM by not making it strict? Some ESPs DKIM will never align so I can't set to strict. But then malicious actors can simply pass DKIM authentication but not alignment if relaxed? Should at least SPF or DKIM be set to strict?
    – mirkaim
    Jan 13 at 20:21
  • Relaxed vs strict doesn't matter (no "hole") unless you share your organizational domain with others. Relaxed means d=mail.example.com aligns with [email protected] while strict would require d=example.com. DMARC p=none instructs mail servers to deliver the spoofed mail and report it to you. ESPs can be configured to add their (unaligned) DKIM and another that you have delegated (this is why it has selectors). DMARC will ignore unaligned DKIM.
    – Adam Katz
    Jan 13 at 22:05
  • Ah thanks for the info. I'm trying to put together a quick cheat sheet for this DMARC implementation so I can easily spot check results. I've read a lot but could you confirm that SPF and DKIM are not concerned with alignment on their own and that the alignment concept is an augmentation of these existing methods by DMARC? And since DMARC is concerned with RFC5322.From, this is the basis of "alignment" to the RFC5322.From header? That SPF and DKIM do their own checks but "SPF aligmnent" and "DKIM alignment" are outside each's own specifications and are actually of DMARC's specification?
    – mirkaim
    Jan 14 at 0:01
  • Alignment is a DMARC-specific term (see my link) and refers to the relation (or lack thereof) of SPF or DKIM to the From header. While DMARC does allow you to specify strict or relaxed separately between SPF and DKIM, that doesn't matter for most uses (the default adkim:r;aspf:r is almost always sufficient).
    – Adam Katz
    Jan 15 at 18:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .