31
votes
Accepted
"Undelivered Mail" I never sent (after registration on website)
It looks like the web service in question has configured their system to forward the welcome emails to an internal address on their end, but misconfigured their system such that the From: line is the ...
- 2,412
13
votes
Spoofed email sent to me from my email address with SPF/DKIM/DMARC passing
TL;DR: this does not look like a hack but like a broken mail setup for your domain. The DKIM pass and SPF pass are the result of your mail setup accepting the original mail and then forwarding it to ...
- 208k
10
votes
Accepted
Can DMARC's SPF alignment be spoofed?
Yes. SPF can be spoofed, but it's not easy.
The only reliable ways to do it are with DNS hijacking (such as a MitM attack, which DNSSEC spoils) or with IP spoofing like BGP hijacking. Both of these ...
- 12.1k
9
votes
Accepted
DMARC "policy_evaluated" is "fail" for SPF, even when SPF domain alignment is "relaxed"?
Relaxed in DMARC doesn't mean completely liberated, but has limitations.
From RFC 7489, 3.1.2 SPF-Authenticated Identifiers (emphasis is mine):
In relaxed mode, the [SPF]-authenticated domain and ...
- 19.4k
7
votes
Accepted
How did a phishing email pass SPF, DKIM and DMARC?
From: Bank Of America <[email protected]> is the address used in the header.from field, so technically the email didn't spoof Bank of America but an Uber.com email address with a ...
- 277
7
votes
Accepted
Enforcing DMARC policy (reject) on an Office 365 tenant
This can be achieved on an Office 365 tenant by adding a transport rule. An email not passing DMARC tests of a domain having p=reject will have dmarc=fail action=oreject and compauth=fail reason=000 ...
- 19.4k
6
votes
Accepted
Understand DMARC report before starting quarantine
Since DMARC passes when SPF or/and dkim passes.
This assumption is wrong. DMARC passes when SPF or/and DKIM passes and the passed SPF/DKIM is identity-aligned according to the DMARC policy.
Can I ...
- 208k
5
votes
Accepted
Why set up DMARC for SPF if it's already set up for DKIM?
I don't think there is a simple answer for your question. Both SPF and DKIM are by their own useful in fighting spam but they miss the alignment between the claimed sender in the mail header compared ...
- 208k
5
votes
Accepted
DMARC report for mails I didn't send
Although these DMARC reports show that both DKIM and SPF verifications failed (this should be reassuring, right?), I'm a bit worried of what it actually means.
The main point of a DMARC report is to ...
- 208k
5
votes
Accepted
Does gmail still ignore DKIM if SPF passes, DMARC style?
That article mentions a new "security warning" in which:
On the web or Android, if you receive a message that can’t be authenticated with either Sender Policy Framework (SPF) or DKIM, you’...
- 12.1k
5
votes
Accepted
Rejected because of DKIM check fail; alignment check fail
That's referring to DMARC Alignment. For DMARC to pass, you need either authorization via SPF on an aligned domain or else a valid signature via DKIM on an aligned domain.
Unless you've specified ...
- 12.1k
5
votes
"Undelivered Mail" I never sent (after registration on website)
It used to be a fairly common practice to forge the sender on some internal emails so that the admin can easily add your address to their address book.
such practice runs foul of DKIM, VERP, and SPF ...
- 1,376
4
votes
Why did spoof email receive a "pass"? And why didn't it show up in the aggregate report?
While you consider this email as spoofed it is actually not, or at least not really spoofed. It comes from a valid gmail account which has no relation to your company. And the only "spoofing" which ...
- 208k
4
votes
DMARC policy result when exactly one of SPF and DKIM fails and exactly one succeeds
from my uderstanding of the RFC this should be default behaviour. if you have set the fo field in the dmarc record it will modify this.
Recievers are permitted to process the message as they see fit, ...
- 187
4
votes
DMARC none policy overwrites local policy
TL;DR: A DMARC policy of none does not mean that the mail should be accepted. It only means that it should not be rejected/quarantined based on a failed DMARC check. It can still be rejected based on ...
- 208k
4
votes
Accepted
Does a domain with no SPF record count as a DMARC pass or fail?
A DMARC pass requires that there is either a valid and aligned DKIM signature OR an a SPF check which returned Pass and which has an aligned claimed sender.
This means, that if there is a valid and ...
- 208k
4
votes
How did a phishing email pass SPF, DKIM and DMARC?
I entered the header in an email header parser, and it passes because it comes from an authorised and valid uber.com IP address for sending emails (50.31.36.149).
But the DKIM body signature check ...
- 132k
4
votes
Why is DMARC failing when SPF and DKIM are passing?
DMARC fails since the sender domain according to the From field of the mail header is different to the sender domain in the SMTP envelope (SPF validation) and different to the domain given in the DKIM ...
- 208k
4
votes
Do fowarded emails retain DMARC protection?
This depends on how exactly forwarding is done and DMARC is setup by the sender and checked by the recipients MTA. DMARC can be based on SPF or DKIM. SPF relies solely on the senders MTA source IP ...
- 208k
4
votes
What is the point of having SPF and DKIM set up, but having DMARC with policy=none?
First, there is a difference between having no DMARC policy and having a policy of p=none. No DMARC policy happens when there is no valid DMARC setting for the domain configured in DNS. But this case ...
- 208k
4
votes
Accepted
How to fix DMARC alignment failure
This problem seems to be introduced by mail forwarding. It looks like the original mail was sent to the customers domain hosted by strato.com and from there automatically forwarded to a gmail.com ...
- 208k
3
votes
Accepted
Bypassing OpenDMARC checks by forging Authentication-Results
You need to harden some other parts in your configuration:
OpenDMARC can and should check the SPF independently. /etc/opendmarc.conf for every MX:
SPFIgnoreResults true
SPFSelfValidate true
...
- 19.4k
3
votes
Suspicious Entry in DMARC Report
It has already been agreed that there is too little information to work with in this question, but I'd still like to point out the two most plausible and non-malicious explanations in case the ...
- 31
3
votes
Why so many DMARC failures? When to move on?
In a very similar situation at the moment,
Based on several weeks of deploying DMARC:
Know your mail flows and which mail servers send mail from your environment or on your behalf. Start by updating ...
- 61
3
votes
Accepted
Dmarc: Why do I have dkim=fail, spf=fail and result=pass
TL;TR: someone send a mail with the SMTP envelope of otherdomain.com but the mail header From mydomain.com. Since the SPF check passed for otherdomain.com it might have been someone from otherdomain....
- 208k
3
votes
Email "FROM address" is changed to an unexpected email address
TL;DR: This is probably a feature of the mailing list to prevent DMARC from failing.
It is well known that DMARC does not survive DMARC+SPF on mailing lists, as to prevent SPF tests from failing the ...
- 19.4k
3
votes
Accepted
What is the point of having SPF and DKIM set up, but having DMARC with policy=none?
DMARC does two things:
It informs you about what mail lacks verifiable SPF and DKIM (with From header alignment)
It allows you to block mail from your domain that is neither SPF-approved nor DKIM-...
- 12.1k
3
votes
How did this paypal spoof email pass SPF, DKIM and DMARC
"Spoofing" is generally considered to be some form of forged message, usually through taking advantage of something within the DNS records, messaging system, or other aspect outside of the ...
- 151
3
votes
How did this paypal spoof email pass SPF, DKIM and DMARC
This is a legitimate email that Paypal has been sending for over a decade, there is nothing suspicious about it.
Here's a post from 2012 with exactly the same email https://www.flickr.com/groups/...
3
votes
DMARC falsely reports impersonation
The DKIM and SPF checks pass for the 3rd party domain, but DMARC fails because the domain is not aligned with your domain. If you wish to enable DMARC, the contractors must either DKIM sign with your ...
- 19.4k
Only top scored, non community-wiki answers of a minimum length are eligible