Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [spf]

Sender Policy Framework (SPF) is an email authentication method designed to detect forged sender addresses in emails (email spoofing), a technique often used in phishing and email spam.

2
votes
2answers
103 views

SPF and Office 365 email accounts spoofing other Office 365 email accounts

After an incident, I have a question which answer's I cannot find. I cannot provide the real headers as they come from a client. Let’s consider a company which uses an Office365 tenant as mail server....
0
votes
1answer
41 views

DMARC “policy_evaluated” is “fail” for SPF, even when SPF domain alignment is “relaxed”?

A DMARC aggregate report which I received reads (irrelevant pieces removed, domains changed): <record> <row> <policy_evaluated> <disposition>none</...
3
votes
2answers
194 views

How did a phishing email pass SPF, DKIM and DMARC?

A friend received a spoofed email (from Bank of America using an uber.com address) which was correctly identified as 'spam' by Gmail. However, looking at the raw message it seems to have passed SPF, ...
1
vote
1answer
58 views

What is the reason for DMARC spec to not require specifically SPF or DKIM pass?

DMARC produces "pass" result if and only if at least one of SPF and DKIM checks pass. It has been noted that DKIM provides stronger protection of the two (if implemented properly). But, in order to ...
0
votes
1answer
54 views

Soft-fail vs Hard-fail SPF + Monitor vs Reject+Strict DMARC, could it be counterproductive?

I have a ProtonMail premium plan with one custom domain and a single email address. My domain DNS is protected with DNSSEC. What caught my eye were two things they recommended in the domain setup: ...
1
vote
1answer
32 views

Does a domain with no SPF record count as a DMARC pass or fail?

Learning about how SPF/DMARC work right now. What I don't see a lot of the articles covering is what happens if there is no published SPF record for the domain. From what I can see most mail servers ...
3
votes
2answers
129 views

Email verification by sending mail instead of receiving

I have an app whose main purpose is to help people track emails they send. In most user onboarding, The user is sent a secret URL via email. They validate by clicking a link to return the secret. ...
1
vote
2answers
83 views

SPF, DKIM and DMARC - How do receiving/recipient mail servers know how and when to validate the mail?

I have spent a bit of time researching SPF, DKIM and DMARC mechanisms however If I understand correctly, these help the recipient to confirm whether the domain is legitimate but only if they have ...
9
votes
4answers
3k views

Spam email “via” my domain, but SPF record exists

I just got an email from some random person's name "via" info@mydomain.com, although info@mydomain.com is just a distribution group within G Suite. We have an up-to-date SPF record added from Google, ...
114
votes
5answers
18k views

Why do phishing e-mails use faked e-mail addresses instead of the real one?

I read that you can write anything into the From: field of an e-mail. If that is true, then why are phishing e-mails trying to trick me with look-a-like addresses like service@amaz0n.com instead of ...
2
votes
2answers
102 views

How are SPF records used in practice?

I always thought that receiving email servers check the "from" domain's SPF record to verify that the sending server is allowed to send email. For example, if I sent email from "atte@atte.com", the ...
0
votes
1answer
139 views

dkim passes under a different domain's dkim

I read that a SPF fail with DKIM pass means someone has forwarded an email with our domain name attached. I haven't sent any emails to this domain. Is this domain trying to send emails with my domain? ...
2
votes
3answers
216 views

Is it possible to defend against a backscatter attack?

Yesterday, some spammer on the other side of the world decided to send out a ton of phishing mails with my business mail address as both From address and envelope sender. The usual best practices are ...
1
vote
2answers
338 views

Can a custom return path make SPF redundant

My understanding is that SPF can be used to define a set of IP addresses that are permitted to send outbound emails on behalf of a domain. If a mail server that is not included in the set of permitted ...
0
votes
1answer
38 views

Does it make sense to check SPF Record if a majority of customers don't abide their own Records?

so I've already disabled error checking for SPF Records after my inital question here: Does error checking for SPF Records make sense? Unfortunately I still have about 2-10 Companies daily who can't ...
1
vote
2answers
51 views

Does error checking for SPF Records make sense?

I've made an SPF Record for my company domain and I took great carefulness to have it done properly without any errors. I've also set up our mailgateway to check SPF Records of all incoming emails ...
2
votes
2answers
274 views

Is it safe to add IP address to SPF record

I am a programmer who manages online exchanges user also and i have been asked to add IP address to SPF record so that one of the application can hosted on Azure can send emails to user etc.. v=spf1 +...
2
votes
2answers
189 views

Can SPF be bypassed by using a shared email server?

As I understand it, SPF works by listing permitted SMTP server domains in the TXT DNS record of the domain you own. So if I own example.com and wish to permit a 3rd-party SMTP server at smtpexample....
0
votes
1answer
198 views

DMARC and SPF are setup for my non-www domain but doesn't work for www

My website is up and running on www.example.com and I am sending automated emails from my email address support@example.com. DMARC and SPF seem to setup accordingly: _dmarc : v=DMARC1;p=none;pct=100;...
0
votes
2answers
204 views

Which SPF quantifier applies when an SPF include is used?

An SPF record has several tags of which one can be the include tag, and the SPF record ends with a quantifier like +, ?, ~ or -. When an include tag is used, the included SPF record has it’s own SPF ...
1
vote
2answers
3k views

Do SPF records apply to all subdomains?

Does a SPF record apply only on the domain it’s setup for or also for all it’s subdomains? For example an SPF record that is configured for the domain example.com will set the policy for mails ending ...
0
votes
1answer
221 views

What is the SPF domain value based on in DMARC aggregate reports?

As I'm reading DMARC aggregate reports, I've come across a few records that have <auth_results><spf><domain> values that don't match the envelope from, header from, or source IP ...
1
vote
1answer
159 views

How to disable email for a subdomain without using SPF

I am working on a tool that checks SPF records, and would like a way to be able to disable email from a testing subdomain, and its children, so that my test domains are not easy targets for spammers ...
0
votes
1answer
33 views

Are emails from the Necurs bot net DKIM and/or SPF signed?

As the questions title already asks: Are emails sent by Necurs DKIM and/or SPF signed? Or are they unsigned and simply spoofed?
1
vote
2answers
247 views

SPF and DKIM passes for SPAM message when using SES and Google Mail

We have websites hosted on AWS, are using SES to send out mailings, and use Google Mail for sending and receiving company mail. Every so often I receive SPAM emails to my Priority Inbox in Google ...
2
votes
2answers
425 views

DMARC policy result when exactly one of SPF and DKIM fails and exactly one succeeds

E-mail forwarding can break SPF, but it should not break DKIM. I want to make a DMARC policy that will evaluate to "pass" when either DKIM or SPF passes, and "fail" when neither DKIM or SPF passes. ...
3
votes
1answer
353 views

Understand DMARC report before starting quarantine

I work for a small company. We have lot of IP black listed because of spamming. We decided to setup dmarc for our mail server. This has been setup and is working correctly. The issue now is that in ...
4
votes
1answer
351 views

Why set up DMARC for SPF if it's already set up for DKIM?

I have SPF and DKIM. I'm planning on adding DMARC to tell receivers to expect SPF and/or DKIM. I've read that it's best to set DMARC up with both SPF and DKIM, but I don't understand exactly when ...
2
votes
1answer
3k views

Dmarc: Why do I have dkim=fail, spf=fail and result=pass

I have set up my company dmarc. It is in test mode and I regularly receive reports. Some seem weird to me and I would like to understand. For example, I have received a report with SPF and dkim failed,...
1
vote
1answer
1k views

How to read dmarc record for a report?

I have a dmarc file containing some record. I am bit surprised by the result and I would like to make sure I am reading it correctly. Here is the record: <record> <row> &...
0
votes
1answer
58 views

Why is DKIM configuration testing not working the same for every test site?

basically, I have setup spk, dkim and dmarc for mail authentication. For this, I used this tuto. All worked correctly and I got this result: seems like everything OK. Now to confirm everything is ...
0
votes
2answers
166 views

Email SPF record integrity

I have been reviewing my company's SPF record with a number of our SAAS providers. One service advised me to use 'include:amazonses.com' in my record to allow emails to be validated. I am rather ...
4
votes
2answers
3k views

How can I prevent email spoofing from my domain?

I recently registered a domain name, and set up an email account tied to it with Zoho mail. I'm concerned about making sure all emails from this domain are signed to prevent spoofing. I've enabled ...
3
votes
1answer
205 views

What does a failed SPF record tell me from a DMARC Aggregate report?

I just started receiving DMARC aggregate reports. I am trying to understand what it means for a Source IP to fail SPF. Does this mean that the domain that failed the SPF tried to send an email on ...
0
votes
4answers
147 views

Suspicious Entry in DMARC Report

I recently contacted a vendor of security-related development libraries to ask for a quote (I won't name them yet). The next day, Postmark sent me my weekly DMARC report - and it contained 2 failed ...
3
votes
0answers
79 views

How does SPF makes life any harder for a spammer/phisher? [duplicate]

I am studying a little bit SPF and other spam/phishing prevention techniques that have been developed during the years, and I have a few question about SPF. I know the difference between the MAIL FROM ...
3
votes
1answer
149 views

Are high levels of email spam normal?

I have got my SPF, DKIM & DMARC records correctly setup and I have started using a DMARC analysis service. One thing I have noticed is the volume failures. For example, in the last 3 days I have ...
0
votes
2answers
5k views

Security of SPF vs SPF and DKIM in email

I am looking for an email provider that I will use with custom domain, one provider is cheaper but has only SPF while the other is more expensive but uses both SPF and DKIM and I'm not sure if paying ...
0
votes
2answers
559 views

Why did spoof email receive a “pass”? And why didn't it show up in the aggregate report?

Good Morning All, I've been thrown into the deep end with a request from my director. I know little of DMARC and email spoofing in general, but I'm trying to somehow weed out WHY this spoof email "...
1
vote
2answers
510 views

Is reverse DNS a must have to prevent emails delivered as spam?

I was considering setting up my own mail server and one of the things I've read about is that I must setup reverse DNS to do not get caught by a spam filter. Is that really a must? Aren't SPF and ...
1
vote
1answer
135 views

Missing DKIM, but having digital signature, will this help mitigate ending up in spam folder?

According to this mail tester: https://www.mail-tester.com I am quite fine with sending emails from my domain's email info@vlastimilburian.cz According to this mail tester: http://mailtester.com/...
2
votes
1answer
188 views

How can I prove that mail sent was NOT caused by the newly deployed DMARC policy?

I understand that by publishing an initial p=none policy, you basically instruct recipients that participate in DMARC to NOT treat incoming mail any different than how they did before a DMARC policy ...
2
votes
1answer
155 views

DMARC annoyances

I've recently setup a mail server, which will be handling email for multiple people and domains. Appropriate SPF, DKIM, DMARC and ADSP records have been added, yet I'm getting something confusing: ...
0
votes
2answers
299 views

Mail delivery delay at ``spf=fail``; may that be due to manual inspection and accept?

A mail was delivered through a forward, with the final location at a company email server. During this delivery there was a pretty long delay, and it looks like the delay is the result of SPF (Sender ...
2
votes
1answer
116 views

Best email SPF practice for dispersed users?

I am the sysadmin for my church. Our church has our own domain website and email hosted externally. We have about 50 members or so who use their church email from home. I am just looking for best ...
0
votes
1answer
817 views

DKIM/SPF problem causing lots of DMARC reports

I get messages from "noreply-dmarc-support@google.com" with a DMARC report as follows: <?xml version="1.0" encoding="UTF-8" ?> <feedback> <report_metadata> <org_name>...
2
votes
2answers
293 views

What precautions should I take before letting users send email through my app?

I'm working on a contact management/lightweight CRM app, and I'd like to be able to allow my users to send email to their contacts through my application. Obviously this opens up a huge can of worms ...
1
vote
2answers
394 views

Does the use of the non-registered domains in SPF records introduce a security risk?

Recently I was reading about the Sender Policy Framework (SPF) record syntax on OpenSPF.com. Sender Policy Framework (SPF) is a simple email-validation system designed to detect email spoofing by ...