Questions tagged [spf]

Sender Policy Framework (SPF) is an email authentication method designed to detect forged sender addresses in emails (email spoofing), a technique often used in phishing and email spam.

Filter by
Sorted by
Tagged with
0 votes
1 answer
65 views

DMARC falsely reports impersonation

I have set up DMARC for some months now and I am using dmarc-visualizer to parse the reports. Overall I am happy so we can advance towards BIMI, but before switching to quarantine or reject on DMARC, ...
user avatar
  • 1
0 votes
1 answer
27 views

Authorizing 3rd Party Envelope Sender to Impersonate Header Sender

Rewriting for clarity: This is regarding emails send from a 3rd party marketer spoofing one of our email addresses in the message header from field. In these emails the envelope sender would come ...
user avatar
0 votes
1 answer
483 views

How does this scam email from a seemingly legit domain work?

I received a strange email from security@facebookmail.com. Sources on the internet seem to state that this is a Facebook-owned domain but I know the email is not legit because they do not address me ...
user avatar
  • 105
4 votes
2 answers
928 views

How to fix DMARC alignment failure

I'm sending emails via the Ionos mail servers. I've got spf set up, but dmarc still fails. This seems related to: Why is DMARC failing when SPF and DKIM are passing? But I can't figure out how to fix ...
user avatar
0 votes
1 answer
64 views

DMARC aggregated report SPF domain field

I am trying to identify, why some of my e-mails are being marked as spam by recipients, and have therefore set up SPF and DKIM. In order to check that they can be verified, I set up aggregated DMARC ...
user avatar
  • 434
1 vote
1 answer
88 views

SPF records and spoofing

Lets say we have this SPF record v=spf1 include:spf.protection.outlook.com include:spf.onprem.com -all` And this record v=spf1 include:spf.protection.outlook.com include:spf.onprem.com ?all What ...
user avatar
0 votes
1 answer
135 views

Rejected because of DKIM check fail; alignment check fail

I am testing my mail server setup with this tool https://email-test.had.dnsops.gov/ and I am getting suspicious that the tool may not be working right. From what I understand it reports that my ...
user avatar
  • 105
0 votes
0 answers
120 views

Unknown Cause of SPF Fail

I have the following SPF record: v=spf1 include:_spf.mailspamprotection.com include:_spf.google.com ip4:209.85.220.0/24 ~all Although I have included _spf.mailspamprotection.com in my SPF record, ...
user avatar
  • 101
0 votes
1 answer
167 views

Vulnerability : Missing SPF - is this a scam?

I got an email with the following: I am just looking at your SPF records then found following. SPF Records missing safe check which can allow me to send mail and phish easily any victim. PoC: <?...
user avatar
  • 277
-1 votes
1 answer
113 views

Does gmail use SPF or DMARC when sending messages outside of gmail?

I can't seem to find any record of SPF or DMARC in the original messages coming from gmail to my mail server. Does gmail use SPF or DMARC when sending messages outside of gmail?
user avatar
0 votes
3 answers
185 views

Sending Mail from Different Server SPF Record

Firstly, i'm not a mail expert! My workplace owns the domain example.com, until recently we had an application hosted on the LAN that worked fine and sent emails from info@example.com to various ...
user avatar
3 votes
2 answers
138 views

What is the point of having SPF and DKIM set up, but having DMARC with policy=none?

Under this FAQ it says that using policy=none is a way for domain owners to monitor forged emails, without having to set up SPF/DKIM. But what im wondering, because i dont fully understand what SPF/...
user avatar
0 votes
0 answers
32 views

Why do I need DMARC on top of SPF and DKIM? [duplicate]

If SPF is verifying against a set of IP records if the incoming email from a domain was sent from an authorized host piggybacking on the DNS and DKIM does touch the signature of the email and ...
user avatar
0 votes
1 answer
259 views

Whitelisting Email Service for Anti-Spoofing and DMARC

My company uses an Anti-Spoofing Protection based on the SPF Record and has implemented DMARC. Often our users correspond via a "secure" messaging platform like Proofpoint/ZIX/IronPort from ...
user avatar
0 votes
0 answers
426 views

Spoofed email? "X-Source-Sender" and "Received" headers look dodgy

I got sent an email from someone in response to an over 2 year old exchange, and the contents of it look like spam to me. Checking the headers the following looks normal: Return-Path Received & ...
user avatar
  • 279
0 votes
0 answers
101 views

Does SPF protect against spammers who control the initial MTA?

I understand that for most users, the Envelope-from address is the most difficult part of an email to spoof because (I assume) it is checked by the receiving MTA i.e. if you attempt to spoof the "...
user avatar
1 vote
1 answer
2k views

SPF/DMARC for shared email provider (gmail) - how did this email pass SPF?

We recently received an email from a self described "white hat hacker" purporting to be from our own organization. According to the mail headers, spf, dmarc, dkim and arc all passed okay and ...
user avatar
3 votes
1 answer
1k views

Does gmail still ignore DKIM if SPF passes, DMARC style?

This blog post from 2016 shockingly implies that gmail will accept an email if either SPF or DKIM passes. We use G suite SMTP servers, therefore SPF provides almost zero protection from spoofing. Is ...
user avatar
2 votes
1 answer
120 views

If I leave SPF not set on my domain, is that a factor for email servers to mark emails from this domain as spam?

I wonder if the lack of an SPF DNS record is a factor in the decision to mark a message as spam. I understand that an SPF fail is definitively such a factor, i.e. when SPF is configured, but a message ...
user avatar
0 votes
0 answers
38 views

SPF record does not preventing the sender spoofing [duplicate]

I used an SPF record finder online, and the result of this test was they already have an SPF record but I still can send an email as their domain exactly! So, do SPF records prevent email spoofing ...
user avatar
0 votes
1 answer
96 views

Risk in adding shared mail server to my SPF like sendinblue/sendgrid for mail reputation?

My enterprise would like to make some mass mailing to their customers, using a third party solution (e.g.: sendinblue, sendgrid, mailchimp...). Is there a real risk that my domain mail address could ...
user avatar
0 votes
1 answer
167 views

DMARC & failing SPF

I would like to clarify the following scenario with DMARC, (assuming there is a publish DMARC policy): SPF fails No (aligned or any) DKIM records Should result of DMARC check be none or fail? ...
user avatar
  • 103
0 votes
0 answers
42 views

Do we need SPF when we have DKIM? [duplicate]

I always thought that to authenticate email we needed both SPF and DKIM (and DMARC). But email is confusing and recently I found myself asking why we can't do with just SPF or DKIM. I then discovered ...
user avatar
  • 179
4 votes
3 answers
5k views

Why is DMARC failing when SPF and DKIM are passing?

I've seen this question asked before, but unfortunately, don't understand the responses. I think its something to do with "from" headers being defined differently by different standards. I've added ...
user avatar
2 votes
3 answers
1k views

SPF and Office 365 email accounts spoofing other Office 365 email accounts

After an incident, I have a question which answer's I cannot find. I cannot provide the real headers as they come from a client. Let’s consider a company which uses an Office365 tenant as mail server....
user avatar
  • 21
3 votes
1 answer
3k views

DMARC "policy_evaluated" is "fail" for SPF, even when SPF domain alignment is "relaxed"?

A DMARC aggregate report which I received reads (irrelevant pieces removed, domains changed): <record> <row> <policy_evaluated> <disposition>none</...
user avatar
8 votes
2 answers
1k views

How did a phishing email pass SPF, DKIM and DMARC?

A friend received a spoofed email (from Bank of America using an uber.com address) which was correctly identified as 'spam' by Gmail. However, looking at the raw message it seems to have passed SPF, ...
user avatar
  • 593
3 votes
2 answers
187 views

What is the reason for DMARC spec to not require specifically SPF or DKIM pass?

DMARC produces "pass" result if and only if at least one of SPF and DKIM checks pass. It has been noted that DKIM provides stronger protection of the two (if implemented properly). But, in ...
user avatar
0 votes
1 answer
2k views

Soft-fail vs Hard-fail SPF + Monitor vs Reject+Strict DMARC, could it be counterproductive?

I have a ProtonMail premium plan with one custom domain and a single email address. My domain DNS is protected with DNSSEC. What caught my eye were two things they recommended in the domain setup: ...
user avatar
1 vote
1 answer
254 views

Does a domain with no SPF record count as a DMARC pass or fail?

Learning about how SPF/DMARC work right now. What I don't see a lot of the articles covering is what happens if there is no published SPF record for the domain. From what I can see most mail servers ...
user avatar
  • 875
4 votes
2 answers
215 views

Email verification by sending mail instead of receiving

I have an app whose main purpose is to help people track emails they send. In most user onboarding, The user is sent a secret URL via email. They validate by clicking a link to return the secret. ...
user avatar
1 vote
2 answers
284 views

SPF, DKIM and DMARC - How do receiving/recipient mail servers know how and when to validate the mail?

I have spent a bit of time researching SPF, DKIM and DMARC mechanisms however If I understand correctly, these help the recipient to confirm whether the domain is legitimate but only if they have ...
user avatar
  • 13
10 votes
4 answers
3k views

Spam email "via" my domain, but SPF record exists

I just got an email from some random person's name "via" info@mydomain.com, although info@mydomain.com is just a distribution group within G Suite. We have an up-to-date SPF record added from Google, ...
user avatar
  • 213
124 votes
5 answers
19k views

Why do phishing e-mails use faked e-mail addresses instead of the real one?

I read that you can write anything into the From: field of an e-mail. If that is true, then why are phishing e-mails trying to trick me with look-a-like addresses like service@amaz0n.com instead of ...
user avatar
  • 1,675
4 votes
2 answers
415 views

How are SPF records used in practice?

I always thought that receiving email servers check the "from" domain's SPF record to verify that the sending server is allowed to send email. For example, if I sent email from "atte@atte.com", the ...
user avatar
0 votes
1 answer
477 views

dkim passes under a different domain's dkim

I read that a SPF fail with DKIM pass means someone has forwarded an email with our domain name attached. I haven't sent any emails to this domain. Is this domain trying to send emails with my domain? ...
user avatar
2 votes
3 answers
751 views

Is it possible to defend against a backscatter attack?

Yesterday, some spammer on the other side of the world decided to send out a ton of phishing mails with my business mail address as both From address and envelope sender. The usual best practices are ...
user avatar
  • 2,914
4 votes
2 answers
755 views

Can a custom return path make SPF redundant

My understanding is that SPF can be used to define a set of IP addresses that are permitted to send outbound emails on behalf of a domain. If a mail server that is not included in the set of permitted ...
user avatar
  • 167
0 votes
1 answer
92 views

Does it make sense to check SPF Record if a majority of customers don't abide their own Records?

so I've already disabled error checking for SPF Records after my inital question here: Does error checking for SPF Records make sense? Unfortunately I still have about 2-10 Companies daily who can't ...
user avatar
  • 986
1 vote
2 answers
106 views

Does error checking for SPF Records make sense?

I've made an SPF Record for my company domain and I took great carefulness to have it done properly without any errors. I've also set up our mailgateway to check SPF Records of all incoming emails ...
user avatar
  • 986
2 votes
2 answers
717 views

Is it safe to add IP address to SPF record

I am a programmer who manages online exchanges user also and i have been asked to add IP address to SPF record so that one of the application can hosted on Azure can send emails to user etc.. v=spf1 +...
user avatar
  • 163
5 votes
2 answers
672 views

Can SPF be bypassed by using a shared email server?

As I understand it, SPF works by listing permitted SMTP server domains in the TXT DNS record of the domain you own. So if I own example.com and wish to permit a 3rd-party SMTP server at smtpexample....
user avatar
  • 301
1 vote
1 answer
539 views

DMARC and SPF are setup for my non-www domain but doesn't work for www

My website is up and running on www.example.com and I am sending automated emails from my email address support@example.com. DMARC and SPF seem to setup accordingly: _dmarc : v=DMARC1;p=none;pct=100;...
user avatar
  • 113
1 vote
2 answers
503 views

Which SPF quantifier applies when an SPF include is used?

An SPF record has several tags of which one can be the include tag, and the SPF record ends with a quantifier like +, ?, ~ or -. When an include tag is used, the included SPF record has it’s own SPF ...
user avatar
  • 6,194
4 votes
3 answers
11k views

Do SPF records apply to all subdomains?

Does a SPF record apply only on the domain it’s setup for or also for all it’s subdomains? For example an SPF record that is configured for the domain example.com will set the policy for mails ending ...
user avatar
  • 6,194
1 vote
1 answer
453 views

What is the SPF domain value based on in DMARC aggregate reports?

As I'm reading DMARC aggregate reports, I've come across a few records that have <auth_results><spf><domain> values that don't match the envelope from, header from, or source IP ...
user avatar
  • 835
1 vote
1 answer
380 views

How to disable email for a subdomain without using SPF

I am working on a tool that checks SPF records, and would like a way to be able to disable email from a testing subdomain, and its children, so that my test domains are not easy targets for spammers ...
user avatar
  • 3,159
0 votes
1 answer
73 views

Are emails from the Necurs bot net DKIM and/or SPF signed?

As the questions title already asks: Are emails sent by Necurs DKIM and/or SPF signed? Or are they unsigned and simply spoofed?
user avatar
1 vote
2 answers
566 views

SPF and DKIM passes for SPAM message when using SES and Google Mail

We have websites hosted on AWS, are using SES to send out mailings, and use Google Mail for sending and receiving company mail. Every so often I receive SPAM emails to my Priority Inbox in Google ...
user avatar
3 votes
2 answers
1k views

DMARC policy result when exactly one of SPF and DKIM fails and exactly one succeeds

E-mail forwarding can break SPF, but it should not break DKIM. I want to make a DMARC policy that will evaluate to "pass" when either DKIM or SPF passes, and "fail" when neither ...
user avatar
  • 415