Hot answers tagged

63 votes

Can I prove that I did not receive an email?

This is one of those situations where Amazon is asking someone to send a picture proving that a package was never delivered. You can't. In general, you cannot "prove a negative". Trying to ...
user avatar
  • 123k
48 votes
Accepted

Is there any security benefit from emailing a "secure link"?

It provides some benefits in that the sensitive contents are stored on the server, rather than in the body of the email. This means that the link can be revoked to block access (for example, if the ...
user avatar
  • 4,199
32 votes

Can an email be doctored to appear from a different sender on an earlier date?

Yes, there are a bunch of different ways to forge emails. Almost the entire contents of the email your receive is sent as data over SMTP, and as such, the headers are just as forgeable as the body: ...
user avatar
  • 7,125
19 votes

Can I prove that I did not receive an email?

The answer above by @schroeder is spot-on (+1). It is impossible for you as the recipient to prove that you didn't receive an email. However, the sender does have the ability to prove that they sent ...
user avatar
  • 19.8k
17 votes

Can an email be doctored to appear from a different sender on an earlier date?

Existing answers are correct, but incomplete. I would like to highlight two other scenarios. First, about SMTP. Under some conditions, someone can connect directly to the final SMTP server and deliver ...
user avatar
13 votes

Is there any security benefit from emailing a "secure link"?

The SMTP protocol is intended to exchange data in clear text over possibly a number of relays. In addition to the common data interception attacks, each and every relay could examine the message (and ...
user avatar
9 votes

Is there any security benefit from emailing a "secure link"?

Not only do these things lack any significant security benefit. One thing that's underappreciated is the strong security disadvantage and imbalance of power it creates against the recipient. They have ...
user avatar
7 votes

Can an email be doctored to appear from a different sender on an earlier date?

At the SMTP level, the SMTP server receives a fully composed text consisting of the headers, a blank line, and the body. It also has what is called the enveloppe addresses and what are given in other ...
user avatar
4 votes

Sending Mail from Different Server SPF Record

One solution to your issue is to send your mail through your main mail host (the one that is listed in your SPF record) instead of using the local SMTP relay on your server. You will have to get ...
user avatar
  • 18.5k
4 votes

Sending Mail from Different Server SPF Record

Setting up a SPF record that permits a third party, over which we have no control, can send as ‘us’ is the antithesis of Cyber Security. This opinion is not held by the general cybersecurity ...
user avatar
  • 123k
4 votes
Accepted

How to fix DMARC alignment failure

This problem seems to be introduced by mail forwarding. It looks like the original mail was sent to the customers domain hosted by strato.com and from there automatically forwarded to a gmail.com ...
user avatar
4 votes

Can I prove that I did not receive an email?

With @mti2935 already having explained the technical details: "prove" to which standard? To a forensics level as if it were criminal evidence? Nope, you can't. The old problem of proving a ...
user avatar
  • 10.1k
4 votes
Accepted

Can a plain text email contain XSS injection?

No, plain-text email cannot contain a cross-site scripting (XSS) attack.XSS requires scripting, which even HTML email bodies* do not permit. (*HTML attachments opened in web browsers can trigger XSS ...
user avatar
  • 9,428
3 votes

Why isn't there a protocol to exchange PGP keys?

PGP was designed to use a decentralized web of trust: As time goes on, you will accumulate keys from other people that you may want to designate as trusted introducers. Everyone else will each choose ...
user avatar
  • 9,428
3 votes

What is the point of having SPF and DKIM set up, but having DMARC with policy=none?

First, there is a difference between having no DMARC policy and having a policy of p=none. No DMARC policy happens when there is no valid DMARC setting for the domain configured in DNS. But this case ...
user avatar
3 votes

How does ProtonMail manage search?

The above responses are out-of-date. It is now possible to search message content to easily find the email you're looking for, all without giving ProtonMail access to your messages. To search your ...
user avatar
  • 131
3 votes
Accepted

How does this scam email from a seemingly legit domain work?

1. How did it pass SPF, DKIM and DMARC? It doesn't. From the snippet you provide, SPF, DMARC and DKIM are either not present or fail. The email address has just been spoofed. Authentication-Results: ...
user avatar
  • 10.8k
3 votes

Cipher suite choice on macOS on Apple Silicon

Apple has an AES engine as part of the Secure Enclave subsystem. It provides: a boot ROM to establish a hardware root of trust, an AES engine for efficient and secure cryptographic operations, and ...
user avatar
  • 738
2 votes
Accepted

Company sent me a registration email with a clear text password

There is no reason to send a password in plain text. The password, once entered, should be securely hashed using a suitable password hashing function with strong salt, and the plaintext should be ...
user avatar
  • 7,125
2 votes
Accepted

What is the point of having SPF and DKIM set up, but having DMARC with policy=none?

DMARC does two things: It informs you about what mail lacks verifiable SPF and DKIM (with From header alignment) It allows you to block mail from your domain that is neither SPF-approved nor DKIM-...
user avatar
  • 9,428
2 votes
Accepted

Is it safe to open email links in a private window?

It may protect against certain session hijacking attacks, but if the link points to a browser exploit then it doesn't matter whether or not you're in a private window. If you don't trust the links, ...
user avatar
  • 4,199
2 votes

Are e-mails that have a name slightly different from the web page legitimate e-mails?

These can sometimes be threats, but not this time. That's probably a legitimate Change.org email. There are two related concepts here. The first is subdomains, children of the main domain that can ...
user avatar
  • 9,428
2 votes
Accepted

Why isn't there a protocol to exchange PGP keys?

WKD (how it works) WKD can be implemented in two ways. However as per draft-koch-openpgp-webkey-service-12 the advanced implementation is the preferred modus operandi. Advanced implementation A E-Mail ...
user avatar
  • 212
2 votes
Accepted

If email is an insecure medium, why are usernames and passwords sent via email (albeit in separate ones)?

It is usually a trade-off between user experience and security. How the trade-off is made depends on the actual threats. While mail can be seen as inherently insecure, it does not mean that every mail ...
user avatar
2 votes

If email is an insecure medium, why are usernames and passwords sent via email (albeit in separate ones)?

I will first describe what I have understood from your question: For meetings you are sending username password pairs to the participants - they are used to retrieve documents the username and the ...
user avatar
2 votes

SPF records and spoofing

What is happening here depends on the mail server (MTA) applying the policy. In case the address matches the result will be the same: Pass. In case of non-match the result will be different though: ...
user avatar
2 votes

Can an HTML attachment in an email contain a virus?

Yes, HTML can indeed contain malware that causes harm to your computer and/or exfiltrates its data. (Not as much an old-school virus, but that I'm assuming you're using that term as a synonym for ...
user avatar
  • 9,428
2 votes

How are validation links getting triggered by a third party?

This is a known behaviour in gmail, and 94.101.43.5 seems to be associated with Google. Google probably does this to check URLs for scammyness and malware, so they can provide more reliable spam and ...
user avatar
  • 12.6k
2 votes
Accepted

Who is accessing my pop3 email accounts?

You can check the list of IP ranges that Google advertises to the internet. The list does include 209.85.128.0/17 which corresponds to all addresses between 209.85.128.0 and 209.85.255.255. So yes, ...
user avatar
  • 10.8k
2 votes
Accepted

Suspicious hyperlinks (all hex URLs) in e-mail

The reason it looks off is that it's a tracking link (as indicated by /track). This is not entirely uncommon. You can sometimes see it in marketing emails, where every link is automatically rewritten ...
user avatar
  • 29k

Only top scored, non community-wiki answers of a minimum length are eligible