Questions tagged [spf]
Sender Policy Framework (SPF) is an email authentication method designed to detect forged sender addresses in emails (email spoofing), a technique often used in phishing and email spam.
82
questions
0
votes
1
answer
191
views
Still able to spoof emails with strict DMARC, SPF and DKIM enabled
Despite setting up strict DMARC, SPF, and having DKIM enabled, I am still easily able to spoof the "From" address. I can easily do this with PHPMailer on my Mac and even with some free 3rd ...
- 101
0
votes
1
answer
111
views
Spoofed forwarded email? Help with analyzing of DMARC report
Why did this email get forwarded successfully? An XML report is below:
I simply cannot understand the delivery status, a transcript follows:
This email has been automatically forwarded. Despite the ...
- 1,647
0
votes
0
answers
119
views
SPF passes but in Gmail, 'Show Original', top section doesn't show SPF: PASS with IP
When I send an email from my HostGator account to my Gmail account, I see in the header spf=pass...
When I paste the header in this tool -> https://toolbox.googleapps.com/apps/messageheader/
It ...
- 1
0
votes
1
answer
136
views
SPF problems using my ISP's SMTP out-bound server
The spf record for my domain is:
v=spf1 a:smtp.(my-isp).com ip4:(my-static-IP) -all
I have recently added smtp.(my-isp).com to the spf record.
I have sent some test emails to gmail where the outgoing ...
2
votes
1
answer
217
views
Spoofed email: whose fault is it?
My relative received an email from a bill they were expecting to pay. So they paid said bill.
Only problem is: it was a spoofed email, and the real bill only came in later.
I checked the email on the ...
- 133
1
vote
1
answer
125
views
How do SPF and DKIM work together prevent spoofing?
I'm trying to understand how SPF and DKIM can be used to prevent email spoofing. One of the things I find confusing is that the SSID/AUID of a DKIM signed message can be different from both the ...
- 113
0
votes
0
answers
483
views
DKIM/SPF What does it mean when policy_evaluated fails but auth_results passes?
I am trying to get the DKIM and SPF settings correct for a client who uses both GSuite and WordPress to send her emails.
I added this dmarc: v=DMARC1; p=none; rua=mailto:l***@******ney.com; fo=1; ...
- 1
2
votes
2
answers
336
views
Flattening an SPF record - drawbacks and downsides?
I have an SPF record that has too many DNS lookups. Consequence is some mail servers will silently drop emails; RFC7028 says that over 10 lookups:
SPF implementations MUST limit the total number of ...
- 522
6
votes
1
answer
956
views
Can DMARC's SPF alignment be spoofed?
IP addresses can be spoofed. The Envelope-From and Header-From addresses can be spoofed as well. But is it possible to spoof all three at the same time to send a forged email that passes both SPF and ...
- 469
0
votes
1
answer
92
views
DMARC falsely reports impersonation
I have set up DMARC for some months now and I am using dmarc-visualizer to parse the reports.
Overall I am happy so we can advance towards BIMI, but before switching to quarantine or reject on DMARC, ...
- 1
1
vote
1
answer
119
views
Authorizing 3rd Party Envelope Sender to Impersonate Header Sender
Rewriting for clarity:
This is regarding emails send from a 3rd party marketer spoofing one of our email addresses in the message header from field. In these emails the envelope sender would come ...
- 11
0
votes
1
answer
2k
views
How does this scam email from a seemingly legit domain work?
I received a strange email from [email protected]. Sources on the internet seem to state that this is a Facebook-owned domain but I know the email is not legit because they do not address me ...
- 105
4
votes
2
answers
2k
views
How to fix DMARC alignment failure
I'm sending emails via the Ionos mail servers.
I've got spf set up, but dmarc still fails.
This seems related to: Why is DMARC failing when SPF and DKIM are passing?
But I can't figure out how to fix ...
- 143
1
vote
1
answer
131
views
DMARC aggregated report SPF domain field
I am trying to identify, why some of my e-mails are being marked as spam by recipients, and have therefore set up SPF and DKIM. In order to check that they can be verified, I set up aggregated DMARC ...
- 474
1
vote
1
answer
107
views
SPF records and spoofing
Lets say we have this SPF record
v=spf1 include:spf.protection.outlook.com include:spf.onprem.com -all`
And this record
v=spf1 include:spf.protection.outlook.com include:spf.onprem.com ?all
What ...
- 11
0
votes
1
answer
246
views
Rejected because of DKIM check fail; alignment check fail
I am testing my mail server setup with this tool https://email-test.had.dnsops.gov/ and I am getting suspicious that the tool may not be working right.
From what I understand it reports that my ...
- 105
0
votes
0
answers
304
views
Unknown Cause of SPF Fail
I have the following SPF record:
v=spf1 include:_spf.mailspamprotection.com include:_spf.google.com ip4:209.85.220.0/24 ~all
Although I have included _spf.mailspamprotection.com in my SPF record, ...
- 101
0
votes
1
answer
632
views
Vulnerability : Missing SPF - is this a scam?
I got an email with the following:
I am just looking at your SPF records then found following. SPF Records missing safe check which can allow me to send mail and phish easily any victim.
PoC:
<?...
- 287
-1
votes
1
answer
140
views
Does gmail use SPF or DMARC when sending messages outside of gmail?
I can't seem to find any record of SPF or DMARC in the original messages coming from gmail to my mail server.
Does gmail use SPF or DMARC when sending messages outside of gmail?
0
votes
3
answers
506
views
Sending Mail from Different Server SPF Record
Firstly, i'm not a mail expert! My workplace owns the domain example.com, until recently we had an application hosted on the LAN that worked fine and sent emails from [email protected] to various ...
- 129
4
votes
3
answers
312
views
What is the point of having SPF and DKIM set up, but having DMARC with policy=none?
Under this FAQ it says that using policy=none is a way for domain owners to monitor forged emails, without having to set up SPF/DKIM. But what im wondering, because i dont fully understand what SPF/...
- 319
0
votes
0
answers
34
views
Why do I need DMARC on top of SPF and DKIM? [duplicate]
If SPF is verifying against a set of IP records if the incoming email from a domain was sent from an authorized host piggybacking on the DNS and DKIM does touch the signature of the email and ...
0
votes
1
answer
851
views
Whitelisting Email Service for Anti-Spoofing and DMARC
My company uses an Anti-Spoofing Protection based on the SPF Record and has implemented DMARC. Often our users correspond via a "secure" messaging platform like Proofpoint/ZIX/IronPort from ...
0
votes
0
answers
1k
views
Spoofed email? "X-Source-Sender" and "Received" headers look dodgy
I got sent an email from someone in response to an over 2 year old exchange, and the contents of it look like spam to me.
Checking the headers the following looks normal:
Return-Path
Received & ...
- 279
0
votes
0
answers
120
views
Does SPF protect against spammers who control the initial MTA?
I understand that for most users, the Envelope-from address is the most difficult part of an email to spoof because (I assume) it is checked by the receiving MTA i.e. if you attempt to spoof the "...
- 1,834
1
vote
1
answer
2k
views
SPF/DMARC for shared email provider (gmail) - how did this email pass SPF?
We recently received an email from a self described "white hat hacker" purporting to be from our own organization.
According to the mail headers, spf, dmarc, dkim and arc all passed okay and ...
- 113
4
votes
1
answer
2k
views
Does gmail still ignore DKIM if SPF passes, DMARC style?
This blog post from 2016 shockingly implies that gmail will accept an email if either SPF or DKIM passes. We use G suite SMTP servers, therefore SPF provides almost zero protection from spoofing. Is ...
- 43
2
votes
1
answer
130
views
If I leave SPF not set on my domain, is that a factor for email servers to mark emails from this domain as spam?
I wonder if the lack of an SPF DNS record is a factor in the decision to mark a message as spam.
I understand that an SPF fail is definitively such a factor, i.e. when SPF is configured, but a message ...
- 373
0
votes
0
answers
39
views
SPF record does not preventing the sender spoofing [duplicate]
I used an SPF record finder online, and the result of this test was they already have an SPF record but I still can send an email as their domain exactly!
So, do SPF records prevent email spoofing ...
0
votes
1
answer
160
views
Risk in adding shared mail server to my SPF like sendinblue/sendgrid for mail reputation?
My enterprise would like to make some mass mailing to their customers, using a third party solution (e.g.: sendinblue, sendgrid, mailchimp...).
Is there a real risk that my domain mail address could ...
user213795
0
votes
1
answer
197
views
DMARC & failing SPF
I would like to clarify the following scenario with DMARC, (assuming there is a publish DMARC policy):
SPF fails
No (aligned or any) DKIM records
Should result of DMARC check be none or fail? ...
- 103
0
votes
0
answers
44
views
Do we need SPF when we have DKIM? [duplicate]
I always thought that to authenticate email we needed both SPF and DKIM (and DMARC). But email is confusing and recently I found myself asking why we can't do with just SPF or DKIM. I then discovered ...
- 189
7
votes
3
answers
10k
views
Why is DMARC failing when SPF and DKIM are passing?
I've seen this question asked before, but unfortunately, don't understand the responses. I think its something to do with "from" headers being defined differently by different standards. I've added ...
2
votes
3
answers
1k
views
SPF and Office 365 email accounts spoofing other Office 365 email accounts
After an incident, I have a question which answer's I cannot find.
I cannot provide the real headers as they come from a client.
Let’s consider a company which uses an Office365 tenant as mail server....
- 21
5
votes
1
answer
5k
views
DMARC "policy_evaluated" is "fail" for SPF, even when SPF domain alignment is "relaxed"?
A DMARC aggregate report which I received reads (irrelevant pieces removed, domains changed):
<record>
<row>
<policy_evaluated>
<disposition>none</...
8
votes
2
answers
2k
views
How did a phishing email pass SPF, DKIM and DMARC?
A friend received a spoofed email (from Bank of America using an uber.com address) which was correctly identified as 'spam' by Gmail. However, looking at the raw message it seems to have passed SPF, ...
- 591
3
votes
2
answers
222
views
What is the reason for DMARC spec to not require specifically SPF or DKIM pass?
DMARC produces "pass" result if and only if at least one of SPF and DKIM checks pass. It has been noted that DKIM provides stronger protection of the two (if implemented properly). But, in ...
0
votes
1
answer
2k
views
Soft-fail vs Hard-fail SPF + Monitor vs Reject+Strict DMARC, could it be counterproductive?
I have a ProtonMail premium plan with one custom domain and a single email address. My domain DNS is protected with DNSSEC.
What caught my eye were two things they recommended in the domain setup:
...
- 1,647
1
vote
1
answer
460
views
Does a domain with no SPF record count as a DMARC pass or fail?
Learning about how SPF/DMARC work right now. What I don't see a lot of the articles covering is what happens if there is no published SPF record for the domain. From what I can see most mail servers ...
- 885
4
votes
2
answers
227
views
Email verification by sending mail instead of receiving
I have an app whose main purpose is to help people track emails they send.
In most user onboarding, The user is sent a secret URL via email. They validate by clicking a link to return the secret.
...
- 287
1
vote
2
answers
301
views
SPF, DKIM and DMARC - How do receiving/recipient mail servers know how and when to validate the mail?
I have spent a bit of time researching SPF, DKIM and DMARC mechanisms however If I understand correctly, these help the recipient to confirm whether the domain is legitimate but only if they have ...
- 13
11
votes
4
answers
4k
views
Spam email "via" my domain, but SPF record exists
I just got an email from some random person's name "via" [email protected], although [email protected] is just a distribution group within G Suite.
We have an up-to-date SPF record added from Google, ...
- 223
125
votes
5
answers
19k
views
Why do phishing e-mails use faked e-mail addresses instead of the real one?
I read that you can write anything into the From: field of an e-mail.
If that is true, then why are phishing e-mails trying to trick me with look-a-like addresses like [email protected] instead of ...
- 1,697
5
votes
2
answers
506
views
How are SPF records used in practice?
I always thought that receiving email servers check the "from" domain's SPF record to verify that the sending server is allowed to send email. For example, if I sent email from "[email protected]", the ...
- 440
1
vote
1
answer
564
views
dkim passes under a different domain's dkim
I read that a SPF fail with DKIM pass means someone has forwarded an email with our domain name attached. I haven't sent any emails to this domain. Is this domain trying to send emails with my domain? ...
- 13
2
votes
3
answers
901
views
Is it possible to defend against a backscatter attack?
Yesterday, some spammer on the other side of the world decided to send out a ton of phishing mails with my business mail address as both From address and envelope sender.
The usual best practices are ...
- 3,006
4
votes
2
answers
899
views
Can a custom return path make SPF redundant
My understanding is that SPF can be used to define a set of IP addresses that are permitted to send outbound emails on behalf of a domain. If a mail server that is not included in the set of permitted ...
- 167
0
votes
1
answer
99
views
Does it make sense to check SPF Record if a majority of customers don't abide their own Records?
so I've already disabled error checking for SPF Records after my inital question here: Does error checking for SPF Records make sense?
Unfortunately I still have about 2-10 Companies daily who can't ...
- 996
1
vote
2
answers
110
views
Does error checking for SPF Records make sense?
I've made an SPF Record for my company domain and I took great carefulness to have it done properly without any errors.
I've also set up our mailgateway to check SPF Records of all incoming emails ...
- 996
2
votes
2
answers
1k
views
Is it safe to add IP address to SPF record
I am a programmer who manages online exchanges user also and i have been asked to add IP address to SPF record so that one of the application can hosted on Azure can send emails to user etc..
v=spf1 +...
- 153