Hot answers tagged

14 votes

Security of SPF vs SPF and DKIM in email

What benefit would DKIM provide if SPF is already used? If a domain has SPF configured the receiving mail server can check if the claimed sender of the mail according to the SMTP dialog (i.e. MAIL ...
user avatar
10 votes

How to create email that will fool DKIM verifier?

First, nice question. I've checked how Thunderbird behaves by modifying an existing mail and it actually takes the first headers for display of From, To and Subject while the DKIM signature mechanism ...
user avatar
9 votes

Why do email that didn't pass SPF checks go to my mailbox?

When a message fails the SPF check, it doesn't necessarily mean that the message is spam. For example, it's possible that the sender of a legitimate message sent the message from his gmail address, ...
user avatar
  • 19.8k
8 votes
Accepted

Why do email that didn't pass SPF checks go to my mailbox?

It has been known since the original design of SPF that it could only provide some additional information in determining whether or some something is spam. Indeed there are many common circumstances ...
user avatar
7 votes
Accepted

Finding DKIM selectors without mailing

There is no way to detect if DKIM is implemented by the sender without getting a mail from the sender, extracting the selector from the DKIM-Signature header and getting the DKIM policy from DNS based ...
user avatar
7 votes
Accepted

Email verification by sending mail instead of receiving

Relying just on a mail claimed to be send by a specific user will neither be sufficient not practical to verify the sender, even with SPF and/or DKIM validation. Neither SPF nor DKIM validate the ...
user avatar
7 votes
Accepted

How did a phishing email pass SPF, DKIM and DMARC?

From: Bank Of America <peopledevelopment@uber.com> is the address used in the header.from field, so technically the email didn't spoof Bank of America but an Uber.com email address with a ...
user avatar
  • 213
6 votes
Accepted

Understand DMARC report before starting quarantine

Since DMARC passes when SPF or/and dkim passes. This assumption is wrong. DMARC passes when SPF or/and DKIM passes and the passed SPF/DKIM is identity-aligned according to the DMARC policy. Can I ...
user avatar
5 votes
Accepted

Why set up DMARC for SPF if it's already set up for DKIM?

I don't think there is a simple answer for your question. Both SPF and DKIM are by their own useful in fighting spam but they miss the alignment between the claimed sender in the mail header compared ...
user avatar
5 votes
Accepted

Is it safe to post the output of Linux dig (DNS) commands?

If you are running dig on public DNS, then the output is the same for everyone, and Public. But that does not mean that it is "safe". It is possible that you disclose an unsafe amount of info in the ...
user avatar
  • 123k
5 votes

How did a phishing email pass SPF, DKIM and DMARC?

I entered the header in an email header parser, and it passes because it comes from an authorised and valid uber.com IP address for sending emails (50.31.36.149). But the DKIM body signature check ...
user avatar
  • 123k
4 votes
Accepted

Which Domain Validation category does DKIM fall under?

DKIM does not use any certificates at all and is also unrelated to TLS. This means that a question about the kind of validation related to the subject of a certificate does not relate to DKIM at all. ...
user avatar
4 votes

Finding DKIM selectors without mailing

This not entirely accure, the answer by Steffen. There are some commonly used selectors that you can try, and in fact could build your own table of possibliites to pass into a program or script to ...
user avatar
  • 175
4 votes

Why is DMARC failing when SPF and DKIM are passing?

DMARC fails since the sender domain according to the From field of the mail header is different to the sender domain in the SMTP envelope (SPF validation) and different to the domain given in the DKIM ...
user avatar
4 votes
Accepted

Why do we need DKIM to be used along with S/Mime?

S/MIME and DKIM are totally independent from each other. S/MIME signature and encryption is applied by the sender (end user) while DKIM signatures are applied by the mail server of the senders domain. ...
user avatar
3 votes
Accepted

Why CA are mandatory to trust our public key? What if we publish the public key via DNS like in DKIM?

DNS itself is not secure. DNS allows for relaying, so any DNS server that is in the path that a client uses to resolve the domain could lie, or the DNS request itself could be attacked via a MITM. ...
user avatar
  • 41.8k
3 votes
Accepted

Could DKIM be used as a proof that an e-mail was sent by a given party?

The only proof you have with DKIM is that the mail was sent over a specific mail server. You can only conclude that the mail was send by a specific user if the mail server only accepts mails from ...
user avatar
3 votes

Security of SPF vs SPF and DKIM in email

In a nutshell, the difference between SPF and DKIM is simple: SPF uses path-based authentication while DKIM uses an identity-based authentication. SPF uses DNS to publish a record of all mail ...
user avatar
3 votes

Why did spoof email receive a "pass"? And why didn't it show up in the aggregate report?

While you consider this email as spoofed it is actually not, or at least not really spoofed. It comes from a valid gmail account which has no relation to your company. And the only "spoofing" which ...
user avatar
3 votes
Accepted

DKIM/SPF problem causing lots of DMARC reports

This is not an error report but an aggregate report you probably requested by providing the appropriate DMARC policy (i.e. setting the rua field). The report shows that both DKIM and SPF check pass ...
user avatar
3 votes

DMARC policy result when exactly one of SPF and DKIM fails and exactly one succeeds

from my uderstanding of the RFC this should be default behaviour. if you have set the fo field in the dmarc record it will modify this. Recievers are permitted to process the message as they see fit, ...
user avatar
3 votes

Why does DKIM verification succeed with a signature from Yahoo when all headers are spoofed to look like GMail?

Can't be sure without seeing the headers, but my guess is that from/reply-to/return-path are all spoofed and just handed in by the attacker as part of the SMTP transaction. As you said, the HELO is ...
user avatar
  • 1,882
3 votes
Accepted

Does DKIM protect the whole body message?

There is a default value of l: From https://www.rfc-editor.org/rfc/rfc6376#section-3.5 : l= Body length count (plain-text unsigned decimal integer; OPTIONAL, default is entire body). Of course the ...
user avatar
  • 1,017
3 votes
Accepted

DMARC report for mails I didn't send

Although these DMARC reports show that both DKIM and SPF verifications failed (this should be reassuring, right?), I'm a bit worried of what it actually means. The main point of a DMARC report is to ...
user avatar
3 votes
Accepted

Does gmail still ignore DKIM if SPF passes, DMARC style?

That article mentions a new "security warning" in which: On the web or Android, if you receive a message that can’t be authenticated with either Sender Policy Framework (SPF) or DKIM, you’...
user avatar
  • 9,528
3 votes

What is the point of having SPF and DKIM set up, but having DMARC with policy=none?

First, there is a difference between having no DMARC policy and having a policy of p=none. No DMARC policy happens when there is no valid DMARC setting for the domain configured in DNS. But this case ...
user avatar
3 votes
Accepted

Rejected because of DKIM check fail; alignment check fail

That's referring to DMARC Alignment. For DMARC to pass, you need either authorization via SPF on an aligned domain or else a valid signature via DKIM on an aligned domain. Unless you've specified ...
user avatar
  • 9,528
2 votes
Accepted

PGP Key Signing Robot DKIM Verified Emails

This is an interesting idea, and I had to consider for a few moments whether there would be flaws, but there are. (plain) DNS is insecure You already realized this, but you could verify DNSSEC ...
user avatar
  • 23.3k
2 votes

PGP Key Signing Robot DKIM Verified Emails

DKIM only makes the promise that a specific mail server processed the mail. Only DMARC creates is an association between the From header in the mail and the DKIM signature. But this association is ...
user avatar
2 votes

How can I prove that mail sent was NOT caused by the newly deployed DMARC policy?

I run quite busy domains for a year on DMARC p=reject and, after initial pains, things run now more or less unattended. DMARC aggregate reports (RUA) are not hypothetical, surprisingly many domains ...
user avatar
  • 1,182

Only top scored, non community-wiki answers of a minimum length are eligible