Skip to main content
OverflowAI is here! AI power for your Stack Overflow for Teams knowledge community. Learn more

Questions tagged [spf]

Sender Policy Framework (SPF) is an email authentication method designed to detect forged sender addresses in emails (email spoofing), a technique often used in phishing and email spam.

Filter by
Sorted by
Tagged with
0 votes
0 answers
27 views

Is it possible to use Google's SMTP server IP? [closed]

There bunch of Google IPs out there. For example ip4:35.190.247.0/24 ip4:35.191.0.0/16 Is there a way to connect to an existing SMTP server IPs above or create one? The goal is to make a SPF check ...
Pooooooorle's user avatar
0 votes
1 answer
64 views

Can I use multiple email providers with my website's DKIM, DMARC and SPF?

I'm a software developer, with limited Mail server setup experience, running a little side SAAS on the side where I send emails to my customers. My domain has SPF, DMARC and DKIM setup and I use ...
LePrinceDeDhump's user avatar
3 votes
1 answer
179 views

How to know whether e-mail was spoofed?

I am having a hard time understanding the different methods of e-mail verification. I know about DKIM, SPF and DMARC. If I would like to know whether an e-mail I received actually came from the e-...
LAWYLAWY's user avatar
1 vote
0 answers
149 views

Is my DMARC report saying legitmate emails are failing or illegitimate emails are passing? [closed]

I am learning how to improve email deliverability. Along the way, I'm learning about DMARC reports, SPF and DKIM. I have a friend with a small business who said I can practice with this email ...
learningtech's user avatar
6 votes
1 answer
1k views

Spoofed email sent to me from my email address with SPF/DKIM/DMARC passing

I received an email earlier today on my work email address. The email came from the same address—mine—but I didn't send it. It was an email claiming that he was a professional hacker who had hacked my ...
PaulMcF87's user avatar
  • 161
0 votes
1 answer
119 views

How can an email forwarding service send email with a "From" from a domain they don't control, and still pass SPF?

Let's say: [email protected] sends an email to [email protected]. Bob owns the domain bob.com but doesn't manage an emailing server. Instead he uses an email forwarding service (provided by his registrar /...
Basj's user avatar
  • 953
0 votes
1 answer
999 views

Still able to spoof emails with strict DMARC, SPF and DKIM enabled

Despite setting up strict DMARC, SPF, and having DKIM enabled, I am still easily able to spoof the "From" address. I can easily do this with PHPMailer on my Mac and even with some free 3rd ...
Ian W's user avatar
  • 101
0 votes
1 answer
260 views

Spoofed forwarded email? Help with analyzing of DMARC report

Why did this email get forwarded successfully? An XML report is below: I simply cannot understand the delivery status, a transcript follows: This email has been automatically forwarded. Despite the ...
Vlastimil Burián's user avatar
0 votes
0 answers
470 views

SPF passes but in Gmail, 'Show Original', top section doesn't show SPF: PASS with IP

When I send an email from my HostGator account to my Gmail account, I see in the header spf=pass... When I paste the header in this tool -> https://toolbox.googleapps.com/apps/messageheader/ It ...
Bob Aune's user avatar
0 votes
1 answer
276 views

SPF problems using my ISP's SMTP out-bound server

The spf record for my domain is: v=spf1 a:smtp.(my-isp).com ip4:(my-static-IP) -all I have recently added smtp.(my-isp).com to the spf record. I have sent some test emails to gmail where the outgoing ...
Peggy Schafer's user avatar
2 votes
1 answer
312 views

Spoofed email: whose fault is it?

My relative received an email from a bill they were expecting to pay. So they paid said bill. Only problem is: it was a spoofed email, and the real bill only came in later. I checked the email on the ...
Bersan's user avatar
  • 133
1 vote
1 answer
258 views

How do SPF and DKIM work together prevent spoofing?

I'm trying to understand how SPF and DKIM can be used to prevent email spoofing. One of the things I find confusing is that the SSID/AUID of a DKIM signed message can be different from both the ...
jay.lee's user avatar
  • 113
2 votes
0 answers
1k views

DKIM/SPF What does it mean when policy_evaluated fails but auth_results passes?

I am trying to get the DKIM and SPF settings correct for a client who uses both GSuite and WordPress to send her emails. I added this dmarc: v=DMARC1; p=none; rua=mailto:l***@******ney.com; fo=1; ...
OM4U's user avatar
  • 21
2 votes
2 answers
611 views

Flattening an SPF record - drawbacks and downsides?

I have an SPF record that has too many DNS lookups. Consequence is some mail servers will silently drop emails; RFC7028 says that over 10 lookups: SPF implementations MUST limit the total number of ...
Criggie's user avatar
  • 522
7 votes
1 answer
1k views

Can DMARC's SPF alignment be spoofed?

IP addresses can be spoofed. The Envelope-From and Header-From addresses can be spoofed as well. But is it possible to spoof all three at the same time to send a forged email that passes both SPF and ...
hilltothesouth's user avatar
0 votes
1 answer
146 views

DMARC falsely reports impersonation

I have set up DMARC for some months now and I am using dmarc-visualizer to parse the reports. Overall I am happy so we can advance towards BIMI, but before switching to quarantine or reject on DMARC, ...
Alex's user avatar
  • 1
1 vote
1 answer
258 views

Authorizing 3rd Party Envelope Sender to Impersonate Header Sender

Rewriting for clarity: This is regarding emails send from a 3rd party marketer spoofing one of our email addresses in the message header from field. In these emails the envelope sender would come ...
Neobane's user avatar
  • 11
0 votes
1 answer
3k views

How does this scam email from a seemingly legit domain work?

I received a strange email from [email protected]. Sources on the internet seem to state that this is a Facebook-owned domain but I know the email is not legit because they do not address me ...
hb20007's user avatar
  • 559
4 votes
2 answers
3k views

How to fix DMARC alignment failure

I'm sending emails via the Ionos mail servers. I've got spf set up, but dmarc still fails. This seems related to: Why is DMARC failing when SPF and DKIM are passing? But I can't figure out how to fix ...
danielmoessner's user avatar
1 vote
1 answer
193 views

DMARC aggregated report SPF domain field

I am trying to identify, why some of my e-mails are being marked as spam by recipients, and have therefore set up SPF and DKIM. In order to check that they can be verified, I set up aggregated DMARC ...
Tom's user avatar
  • 474
1 vote
1 answer
141 views

SPF records and spoofing

Lets say we have this SPF record v=spf1 include:spf.protection.outlook.com include:spf.onprem.com -all` And this record v=spf1 include:spf.protection.outlook.com include:spf.onprem.com ?all What ...
user269161's user avatar
0 votes
1 answer
358 views

Rejected because of DKIM check fail; alignment check fail

I am testing my mail server setup with this tool https://email-test.had.dnsops.gov/ and I am getting suspicious that the tool may not be working right. From what I understand it reports that my ...
MeSo2's user avatar
  • 105
0 votes
0 answers
408 views

Unknown Cause of SPF Fail

I have the following SPF record: v=spf1 include:_spf.mailspamprotection.com include:_spf.google.com ip4:209.85.220.0/24 ~all Although I have included _spf.mailspamprotection.com in my SPF record, ...
Reza's user avatar
  • 101
0 votes
1 answer
916 views

Vulnerability : Missing SPF - is this a scam?

I got an email with the following: I am just looking at your SPF records then found following. SPF Records missing safe check which can allow me to send mail and phish easily any victim. PoC: <?...
pee2pee's user avatar
  • 297
-1 votes
1 answer
186 views

Does gmail use SPF or DMARC when sending messages outside of gmail?

I can't seem to find any record of SPF or DMARC in the original messages coming from gmail to my mail server. Does gmail use SPF or DMARC when sending messages outside of gmail?
johnnyApplePRNG's user avatar
0 votes
3 answers
1k views

Sending Mail from Different Server SPF Record

Firstly, i'm not a mail expert! My workplace owns the domain example.com, until recently we had an application hosted on the LAN that worked fine and sent emails from [email protected] to various ...
TheOrdinaryGeek's user avatar
4 votes
3 answers
543 views

What is the point of having SPF and DKIM set up, but having DMARC with policy=none?

Under this FAQ it says that using policy=none is a way for domain owners to monitor forged emails, without having to set up SPF/DKIM. But what im wondering, because i dont fully understand what SPF/...
Flying Thunder's user avatar
0 votes
0 answers
36 views

Why do I need DMARC on top of SPF and DKIM? [duplicate]

If SPF is verifying against a set of IP records if the incoming email from a domain was sent from an authorized host piggybacking on the DNS and DKIM does touch the signature of the email and ...
Asian Flavor's user avatar
0 votes
1 answer
1k views

Whitelisting Email Service for Anti-Spoofing and DMARC

My company uses an Anti-Spoofing Protection based on the SPF Record and has implemented DMARC. Often our users correspond via a "secure" messaging platform like Proofpoint/ZIX/IronPort from ...
user2942358's user avatar
0 votes
0 answers
1k views

Spoofed email? "X-Source-Sender" and "Received" headers look dodgy

I got sent an email from someone in response to an over 2 year old exchange, and the contents of it look like spam to me. Checking the headers the following looks normal: Return-Path Received & ...
Brett's user avatar
  • 279
0 votes
0 answers
155 views

Does SPF protect against spammers who control the initial MTA?

I understand that for most users, the Envelope-from address is the most difficult part of an email to spoof because (I assume) it is checked by the receiving MTA i.e. if you attempt to spoof the "...
David Scholefield's user avatar
1 vote
1 answer
3k views

SPF/DMARC for shared email provider (gmail) - how did this email pass SPF?

We recently received an email from a self described "white hat hacker" purporting to be from our own organization. According to the mail headers, spf, dmarc, dkim and arc all passed okay and ...
Dave Smylie's user avatar
4 votes
1 answer
2k views

Does gmail still ignore DKIM if SPF passes, DMARC style?

This blog post from 2016 shockingly implies that gmail will accept an email if either SPF or DKIM passes. We use G suite SMTP servers, therefore SPF provides almost zero protection from spoofing. Is ...
Morrison's user avatar
2 votes
1 answer
168 views

If I leave SPF not set on my domain, is that a factor for email servers to mark emails from this domain as spam?

I wonder if the lack of an SPF DNS record is a factor in the decision to mark a message as spam. I understand that an SPF fail is definitively such a factor, i.e. when SPF is configured, but a message ...
Jan Żankowski's user avatar
0 votes
0 answers
39 views

SPF record does not preventing the sender spoofing [duplicate]

I used an SPF record finder online, and the result of this test was they already have an SPF record but I still can send an email as their domain exactly! So, do SPF records prevent email spoofing ...
iiAnonymous's user avatar
0 votes
1 answer
189 views

Risk in adding shared mail server to my SPF like sendinblue/sendgrid for mail reputation?

My enterprise would like to make some mass mailing to their customers, using a third party solution (e.g.: sendinblue, sendgrid, mailchimp...). Is there a real risk that my domain mail address could ...
user avatar
0 votes
1 answer
249 views

DMARC & failing SPF

I would like to clarify the following scenario with DMARC, (assuming there is a publish DMARC policy): SPF fails No (aligned or any) DKIM records Should result of DMARC check be none or fail? ...
charlag's user avatar
  • 103
0 votes
0 answers
44 views

Do we need SPF when we have DKIM? [duplicate]

I always thought that to authenticate email we needed both SPF and DKIM (and DMARC). But email is confusing and recently I found myself asking why we can't do with just SPF or DKIM. I then discovered ...
SWdV's user avatar
  • 199
8 votes
3 answers
16k views

Why is DMARC failing when SPF and DKIM are passing?

I've seen this question asked before, but unfortunately, don't understand the responses. I think its something to do with "from" headers being defined differently by different standards. I've added ...
Dedicated Managers's user avatar
2 votes
3 answers
2k views

SPF and Office 365 email accounts spoofing other Office 365 email accounts

After an incident, I have a question which answer's I cannot find. I cannot provide the real headers as they come from a client. Let’s consider a company which uses an Office365 tenant as mail server....
Ixiliae's user avatar
  • 21
7 votes
1 answer
7k views

DMARC "policy_evaluated" is "fail" for SPF, even when SPF domain alignment is "relaxed"?

A DMARC aggregate report which I received reads (irrelevant pieces removed, domains changed): <record> <row> <policy_evaluated> <disposition>none</...
Konstantin Shemyak's user avatar
7 votes
2 answers
2k views

How did a phishing email pass SPF, DKIM and DMARC?

A friend received a spoofed email (from Bank of America using an uber.com address) which was correctly identified as 'spam' by Gmail. However, looking at the raw message it seems to have passed SPF, ...
Islay's user avatar
  • 591
3 votes
2 answers
263 views

What is the reason for DMARC spec to not require specifically SPF or DKIM pass?

DMARC produces "pass" result if and only if at least one of SPF and DKIM checks pass. It has been noted that DKIM provides stronger protection of the two (if implemented properly). But, in ...
Konstantin Shemyak's user avatar
0 votes
1 answer
2k views

Soft-fail vs Hard-fail SPF + Monitor vs Reject+Strict DMARC, could it be counterproductive?

I have a ProtonMail premium plan with one custom domain and a single email address. My domain DNS is protected with DNSSEC. What caught my eye were two things they recommended in the domain setup: ...
Vlastimil Burián's user avatar
1 vote
1 answer
715 views

Does a domain with no SPF record count as a DMARC pass or fail?

Learning about how SPF/DMARC work right now. What I don't see a lot of the articles covering is what happens if there is no published SPF record for the domain. From what I can see most mail servers ...
trallgorm's user avatar
  • 885
4 votes
2 answers
275 views

Email verification by sending mail instead of receiving

I have an app whose main purpose is to help people track emails they send. In most user onboarding, The user is sent a secret URL via email. They validate by clicking a link to return the secret. ...
Michael Cole's user avatar
1 vote
2 answers
328 views

SPF, DKIM and DMARC - How do receiving/recipient mail servers know how and when to validate the mail?

I have spent a bit of time researching SPF, DKIM and DMARC mechanisms however If I understand correctly, these help the recipient to confirm whether the domain is legitimate but only if they have ...
Chaplin's user avatar
  • 13
11 votes
4 answers
4k views

Spam email "via" my domain, but SPF record exists

I just got an email from some random person's name "via" [email protected], although [email protected] is just a distribution group within G Suite. We have an up-to-date SPF record added from Google, ...
LewlSauce's user avatar
  • 223
123 votes
5 answers
19k views

Why do phishing e-mails use faked e-mail addresses instead of the real one?

I read that you can write anything into the From: field of an e-mail. If that is true, then why are phishing e-mails trying to trick me with look-a-like addresses like [email protected] instead of ...
JFB's user avatar
  • 1,677
5 votes
2 answers
555 views

How are SPF records used in practice?

I always thought that receiving email servers check the "from" domain's SPF record to verify that the sending server is allowed to send email. For example, if I sent email from "[email protected]", the ...
bkoodaa's user avatar
  • 440