We’re rewarding the question askers & reputations are being recalculated! Read more.

Hot answers tagged

6

I entered the header in an email header parser, and it passes because it comes from an authorised and valid uber.com IP address for sending emails (50.31.36.149). But the DKIM body signature check failed. So, it looks like the phisher got ahold of a valid Uber account and either took an existing email, and replaced the body content, or your edits modified ...


5

A DMARC pass requires that there is either a valid and aligned DKIM signature OR an a SPF check which returned Pass and which has an aligned claimed sender. This means, that if there is a valid and aligned DKIM signature the result of SPF does not matter at all, i.e. it will return DMARC pass no matter what the result from SPF is, which includes the cases ...


5

I don't think there is a simple answer for your question. Both SPF and DKIM are by their own useful in fighting spam but they miss the alignment between the claimed sender in the mail header compared to the SMTP envelope (SPF) or the signature (DKIM). Only DMARC provided this important alignment and adds a policy how do deal with failures on top. But, by ...


5

From: Bank Of America <peopledevelopment@uber.com> is the address used in the header.from field, so technically the email didn't spoof Bank of America but an Uber.com email address with a Display Name property that says Bank of America. The email was sent via a system that is authorized to send on behalf of the uber.com domain. In this case Sendgrid. (...


4

Since DMARC passes when SPF or/and dkim passes. This assumption is wrong. DMARC passes when SPF or/and DKIM passes and the passed SPF/DKIM is identity-aligned according to the DMARC policy. Can I assume that when I have at least one pass in auth_results, it means that in prod (dmarc quarantine or reject), this message would have passed? No, ...


3

TL;DR: A DMARC policy of none does not mean that the mail should be accepted. It only means that it should not be rejected/quarantined based on a failed DMARC check. It can still be rejected based on SPF Fail. DMARC is used to tell receivers of e-mail what to do if SPF or DKIM fails in mails send from your domain. DMARC does not define what happens if ...


3

from my uderstanding of the RFC this should be default behaviour. if you have set the fo field in the dmarc record it will modify this. Recievers are permitted to process the message as they see fit, and may reject a message on an spf fail (with a reject mechanism "-"), but provding the standard is implemented in full and DKIM passes, with the default fo ...


3

While you consider this email as spoofed it is actually not, or at least not really spoofed. It comes from a valid gmail account which has no relation to your company. And the only "spoofing" which was done is that the owner of this account has set the name of your VP as its own name so that it shows up as sender. Google does not know what the real name of ...


3

DMARC fails since the sender domain according to the From field of the mail header is different to the sender domain in the SMTP envelope (SPF validation) and different to the domain given in the DKIM signature. This means there is no alignment of the From domain with a valid DKIM or SPF - but such an alignment is required for DMARC to pass.


2

In a very similar situation at the moment, Based on several weeks of deploying DMARC: Know your mail flows and which mail servers send mail from your environment or on your behalf. Start by updating your SPF records accordingly and remember that all domains AND sub-domains need to have their own SPF records. SPF might still fail due to various reasons (...


2

If you get a mail with was forwarded as a message/rfc822 attachment with all headers instead of inline it is possible to validate the DKIM signature and check the result against a DMARC policy. For other kinds of forwarding (i.e. quoted, prefixed...) this is not possible. It is also not possible for replies since none of these contains both the necessary ...


2

TL;TR: someone send a mail with the SMTP envelope of otherdomain.com but the mail header From mydomain.com. Since the SPF check passed for otherdomain.com it might have been someone from otherdomain.com which tried to spoof the sender to mydomain.com. <identifiers> <header_from>mydomain.com</header_from> </identifiers> This ...


2

What is auth_results are DKIM and SPF results, uninterpreted with respect to DMARC. What is in the policy_evaluated are the results of applying DMARC. disposition is the policy action specified in DMARC record. dkim and spf are DMARC-aligned authentications results. Hope it helps.


2

It has already been agreed that there is too little information to work with in this question, but I'd still like to point out the two most plausible and non-malicious explanations in case the question pops up again. The email you sent to the Vendor was not properly handled by Yourself. Not meaning to point finger, but at any request for help, this should ...


2

It depends a lot on the specific case. If you are really sure you know where all the mail being sent is coming from, and that you’ve set up SPF & DKIM appropriately, then you might go directly to p=reject or p=quarantine. The safer course is to do a staged roll-out, e.g.: p=none with rua and/or ruf set (there are tools like Dmarcian that you can use to ...


2

Relaxed in DMARC doesn't mean completely liberated, but has limitations. From RFC 7489, 3.1.2 SPF-Authenticated Identifiers (emphasis is mine): In relaxed mode, the [SPF]-authenticated domain and RFC5322.From domain must have the same Organizational Domain. In strict mode, only an exact DNS domain match is considered to produce Identifier ...


1

I did not find anything about this but I'm guessing that the arguments went the following way: Both SPF and DKIM might break (forwarding, message transformation). To increase robustness a domain should probably implement both anyway and hopefully only one will break then. There are ways these mechanisms can accidentally fail, but there is no way for an ...


1

... is there a situation where Hard-fail is counterproductive Some mail servers actually reject mails on SPF Fail. Given that SPF has known trouble with mail forwarding services and some mailing list this might lead to loss of mails. For use with DMARC it actually does not matter if SPF is Fail or Soft-Fail. All what matters is if SPF is Pass and this ...


1

Mail servers should use what you put in your DMARC record. In your example, you are telling the mail server that you, as the domain owner, are happy for it to be ignored, but you are asserting that you have made that decision with the DMARC record. Some mail servers could decide what to do, but I believe this would be against the spirit of DMARC. With ...


1

Only one aligned DKIM/SPF pass is necessary for DMARC to pass: If DKIM verifies with alignment, DMARC passes – no policy is triggered (regardless of SPF) If SPF passes with alignment, DMARC passes – no policy is triggered (regardless of DKIM) DMARC passes when either SPF or DKIM is verified and aligned. DMARC can neither explicitly require SPF, nor ...


1

these help the recipient to confirm whether the domain is legitimate but only if they have these mechanisms configured correctly and implemented. No.It helps the recipient to know if the email you received was send by an approved email server. In a scenario where the recipient does not have these particular mechanisms in place or misconfigured, ...


1

SPF, DKIM and DMARC require both that these are setup by the legitimate sender and that these are verified by the recipient. In theory the combination of SPF+DMARC or DKIM+DMARC is sufficient at the sender side, where DKIM is the more robust regarding message forwarding. But if neither SPF nor DKIM is used by the sender and if no DMARC is setup by the sender ...


1

You need to harden some other parts in your configuration: OpenDMARC can and should check the SPF independently. /etc/opendmarc.conf for every MX: SPFIgnoreResults true SPFSelfValidate true Remember that the external SPF will pass for every valid envelope sender, leaving the forged header the one matching for the From header first. Also, the ...


1

I would initially use p=none like the comment mentioned. Upon determining the type and amount of e-mails that get flagged I'd then make an analysis and decide if to drop, quarantine or let them through. In case of very small traffic it's easy to make such determination but for heavy traffic it may prove a little more difficult to filter the good from the ...


1

TL;DR: This is not a problem of an insecure DMARC configuration. The DMARC fail you see is due to a broken DKIM signature. The DKIM signature got broken due to one mail server in the path not supporting 8BITMIME. Fix is to make sure that you have an ASCII-only mail before applying the DKIM signature on your server. I've described the problem in more detail ...


1

Why are these other domains showing up in that field, and where are they from? Within the <auth_results> section of the DMARC report all authentication results are listed, no matter if they get used to compute the DMARC result or not. From the DMARC FAQ: I need to implement aggregate reports, what do they look like?: Please note that the SPF and ...


1

I have a possible solution for you. As RFC 7208, Section 4.6.4 states: Some mechanisms and modifiers (collectively, "terms") cause DNS queries at the time of evaluation, and some do not. The following terms cause DNS queries: the "include", "a", "mx", "ptr", and "exists" mechanisms, and the "redirect" modifier. SPF implementations MUST limit ...


1

If you submitted the query using a Web form and included your e-mail address, the form could then have e-mailed someone within the company "from" your provided e-mail address--and their server could well then have (correctly) treated it as a spoofed address. I've seen such "spoofed" (albeit for legitimate reasons) e-mails before, though haven't witnessed the ...


1

The report by postmark is based on the reports send by mail servers to the configured report address in case a mail was deemed to violate the DKIM/SPF policies. Thus it is highly likely that this is caused by violating the policy (i.e. spoofing) but this is not the only possible explanation. For example someone could make up a policy violation report and ...


1

It looks like that you did not specify any DKIM selector on the second test site. And if the one you use for your site is not one of the several the test site tried then it will fail to check for a DKIM DNS record. Apart from that the second test site seems to have more strict and non-standard requirements than the first site. While it successfully ...


Only top voted, non community-wiki answers of a minimum length are eligible