Hot answers tagged

14

What benefit would DKIM provide if SPF is already used? If a domain has SPF configured the receiving mail server can check if the claimed sender of the mail according to the SMTP dialog (i.e. MAIL FROM) is allowed to send mail from this IP address. This helps against sender spoofing only a bit since only the sender based on the SMTP dialog is checked but ...


9

First, nice question. I've checked how Thunderbird behaves by modifying an existing mail and it actually takes the first headers for display of From, To and Subject while the DKIM signature mechanism starts from the end :( . Thus the DKIM signature is considered valid even though From, To and Subject are spoofed. Interestingly the first From line is only ...


9

When a message fails the SPF check, it doesn't necessarily mean that the message is spam. For example, it's possible that the sender of a legitimate message sent the message from his gmail address, but using an SMTP server other than Gmail's (e.g. his ISP's SMTP server, or a hosted SMTP service). In that case, the message would fail the SPF check, but the ...


8

There is no way to detect if DKIM is implemented by the sender without getting a mail from the sender, extracting the selector from the DKIM-Signature header and getting the DKIM policy from DNS based on this selector. One can check if some commonly used selectors can be found in DNS. But a successful check does not mean that any of these selector actually ...


6

It has been known since the original design of SPF that it could only provide some additional information in determining whether or some something is spam. Indeed there are many common circumstances that can lead to a false fail. Forwarding breaks SPF and causes false fails For example, suppose I have an email address that I don't use, say, JGoldberg@...


6

Relying just on a mail claimed to be send by a specific user will neither be sufficient not practical to verify the sender, even with SPF and/or DKIM validation. Neither SPF nor DKIM validate the sender of the email in the first place. They verify at most that a mail was send using a mail server which is allowed to send mail for the claimed domain - where ...


6

I entered the header in an email header parser, and it passes because it comes from an authorised and valid uber.com IP address for sending emails (50.31.36.149). But the DKIM body signature check failed. So, it looks like the phisher got ahold of a valid Uber account and either took an existing email, and replaced the body content, or your edits modified ...


6

From: Bank Of America <peopledevelopment@uber.com> is the address used in the header.from field, so technically the email didn't spoof Bank of America but an Uber.com email address with a Display Name property that says Bank of America. The email was sent via a system that is authorized to send on behalf of the uber.com domain. In this case Sendgrid. (...


5

I don't think there is a simple answer for your question. Both SPF and DKIM are by their own useful in fighting spam but they miss the alignment between the claimed sender in the mail header compared to the SMTP envelope (SPF) or the signature (DKIM). Only DMARC provided this important alignment and adds a policy how do deal with failures on top. But, by ...


5

If you are running dig on public DNS, then the output is the same for everyone, and Public. But that does not mean that it is "safe". It is possible that you disclose an unsafe amount of info in the public DNS record. But, since it is public, it is already disclosed, and you are not adding more risk by posting it.


4

DKIM does not use any certificates at all and is also unrelated to TLS. This means that a question about the kind of validation related to the subject of a certificate does not relate to DKIM at all. For DKIM the domain owner itself associates a public key only (not a certificate) with the domain by putting it into a DNS TXT record and then uses the ...


4

Since DMARC passes when SPF or/and dkim passes. This assumption is wrong. DMARC passes when SPF or/and DKIM passes and the passed SPF/DKIM is identity-aligned according to the DMARC policy. Can I assume that when I have at least one pass in auth_results, it means that in prod (dmarc quarantine or reject), this message would have passed? No, ...


3

DNS itself is not secure. DNS allows for relaying, so any DNS server that is in the path that a client uses to resolve the domain could lie, or the DNS request itself could be attacked via a MITM. DNSSEC attempts to correct some of this by signing DNS records so that only the owner of a domain can post DNS records authoritatively, but that only works if a) ...


3

The only proof you have with DKIM is that the mail was sent over a specific mail server. You can only conclude that the mail was send by a specific user if the mail server only accepts mails from this specific user (unlikely) enforces that the From header in the mail (which is part of the DKIM signature) matches the actual sender of the mail, i.e. no ...


3

In a nutshell, the difference between SPF and DKIM is simple: SPF uses path-based authentication while DKIM uses an identity-based authentication. SPF uses DNS to publish a record of all mail transfer authorities (MTA) authorized to send mail on behalf of the domain. Recipient MTAs then query DNS for the SPF record and reconcile the list of approved IP ...


3

While you consider this email as spoofed it is actually not, or at least not really spoofed. It comes from a valid gmail account which has no relation to your company. And the only "spoofing" which was done is that the owner of this account has set the name of your VP as its own name so that it shows up as sender. Google does not know what the real name of ...


3

This is not an error report but an aggregate report you probably requested by providing the appropriate DMARC policy (i.e. setting the rua field). The report shows that both DKIM and SPF check pass for this IP address. For more information about how to read this report and how to request it (or stop it) see How to Read Your First DMARC Reports.


3

from my uderstanding of the RFC this should be default behaviour. if you have set the fo field in the dmarc record it will modify this. Recievers are permitted to process the message as they see fit, and may reject a message on an spf fail (with a reject mechanism "-"), but provding the standard is implemented in full and DKIM passes, with the default fo ...


3

Can't be sure without seeing the headers, but my guess is that from/reply-to/return-path are all spoofed and just handed in by the attacker as part of the SMTP transaction. As you said, the HELO is from yahoo, and it is yahoo which signed it. Yahoo isn't attesting to the value(s) of any of the headers in the transaction, just that it was injected into a ...


3

DMARC fails since the sender domain according to the From field of the mail header is different to the sender domain in the SMTP envelope (SPF validation) and different to the domain given in the DKIM signature. This means there is no alignment of the From domain with a valid DKIM or SPF - but such an alignment is required for DMARC to pass.


3

S/MIME and DKIM are totally independent from each other. S/MIME signature and encryption is applied by the sender (end user) while DKIM signatures are applied by the mail server of the senders domain. Similar DKIM is usually verified by the mail server of the receiving domain while S/MIME signature and encryption are verified by the final recipient - the ...


2

This is an interesting idea, and I had to consider for a few moments whether there would be flaws, but there are. (plain) DNS is insecure You already realized this, but you could verify DNSSEC signatures to prevent faked DNS entries. Pinning might be viable, but what to do in case of keys changed in purpose? DKIM signs the domain, not users Quoating RFC ...


2

DKIM only makes the promise that a specific mail server processed the mail. Only DMARC creates is an association between the From header in the mail and the DKIM signature. But this association is restricted only to the domain part of the address, or even only the organizational domain depending on the restrictions in the DMARC record. There is no proof ...


2

I run quite busy domains for a year on DMARC p=reject and, after initial pains, things run now more or less unattended. DMARC aggregate reports (RUA) are not hypothetical, surprisingly many domains does send them, and I don't mean only Google/Microsoft/Yahoo. I haven't seen any forensic report RUF sent to me yet when there was an error (and RUA indicated ...


2

If you get a mail with was forwarded as a message/rfc822 attachment with all headers instead of inline it is possible to validate the DKIM signature and check the result against a DMARC policy. For other kinds of forwarding (i.e. quoted, prefixed...) this is not possible. It is also not possible for replies since none of these contains both the necessary ...


2

As Steffens answer covers that DKIM is not a proof that an email originated from that specific account but rather it has been sent from the mail server responsible for that address, I'm covering the other question as to what might be a proof, i.e How can I be sure an email is from the email address in the From field or from a person associated to that ...


2

No. Obtaining the public key from DNS gives you only half of the picture. You also need a signature to verify against the public key, and that signature is only going to appear in an actual email. Without a signature you have no idea if the policy domain's MTA is configured to even sign outgoing mail at all, or with the right key, or with the right selector, ...


2

If I run my own DNS server I would be able forge any public key for any domain without the final client noticing anything.


2

Yes DKIM and SPF as you say do go some way in helping fight against spoofing. It's not the clients that tend to ignore the likes of DKIM it's the receiving email server that does not bother to check the result, or fails to adequately act on the result. I suspect many large email providers would rather accept more spam over loss of legitimate traffic or ...


2

You could go beyond SPF - add DKIM to the mix, and you can use DMARC, which will not only prevent spoofed emails, but also allows you to receive reports of them. SPF basically lets you list your legitimate servers, and DKIM signs emails to attest to their validity. DMARC then allows you to define how receivers should deal with email that fails SPF or DKIM ...


Only top voted, non community-wiki answers of a minimum length are eligible