63
votes
Can I prove that I did not receive an email?
This is one of those situations where Amazon is asking someone to send a picture proving that a package was never delivered. You can't.
In general, you cannot "prove a negative".
Trying to ...
- 123k
48
votes
Accepted
Is there any security benefit from emailing a "secure link"?
It provides some benefits in that the sensitive contents are stored on the server, rather than in the body of the email. This means that the link can be revoked to block access (for example, if the ...
- 4,199
32
votes
Can an email be doctored to appear from a different sender on an earlier date?
Yes, there are a bunch of different ways to forge emails. Almost the entire contents of the email your receive is sent as data over SMTP, and as such, the headers are just as forgeable as the body: ...
- 7,125
19
votes
Can I prove that I did not receive an email?
The answer above by @schroeder is spot-on (+1). It is impossible for you as the recipient to prove that you didn't receive an email. However, the sender does have the ability to prove that they sent ...
- 19.8k
17
votes
Can an email be doctored to appear from a different sender on an earlier date?
Existing answers are correct, but incomplete. I would like to highlight two other scenarios.
First, about SMTP.
Under some conditions, someone can connect directly to the final SMTP server and deliver ...
- 583
13
votes
Is there any security benefit from emailing a "secure link"?
The SMTP protocol is intended to exchange data in clear text over possibly a number of relays. In addition to the common data interception attacks, each and every relay could examine the message (and ...
- 25.6k
9
votes
Is there any security benefit from emailing a "secure link"?
Not only do these things lack any significant security benefit. One thing that's underappreciated is the strong security disadvantage and imbalance of power it creates against the recipient. They have ...
7
votes
Can an email be doctored to appear from a different sender on an earlier date?
At the SMTP level, the SMTP server receives a fully composed text consisting of the headers, a blank line, and the body. It also has what is called the enveloppe addresses and what are given in other ...
- 25.6k
4
votes
Sending Mail from Different Server SPF Record
One solution to your issue is to send your mail through your main mail host (the one that is listed in your SPF record) instead of using the local SMTP relay on your server.
You will have to get ...
- 18.5k
4
votes
Sending Mail from Different Server SPF Record
Setting up a SPF record that permits a third party, over which we have
no control, can send as ‘us’ is the antithesis of Cyber Security.
This opinion is not held by the general cybersecurity ...
- 123k
4
votes
Accepted
How to fix DMARC alignment failure
This problem seems to be introduced by mail forwarding. It looks like the original mail was sent to the customers domain hosted by strato.com and from there automatically forwarded to a gmail.com ...
- 183k
4
votes
Can I prove that I did not receive an email?
With @mti2935 already having explained the technical details:
"prove" to which standard? To a forensics level as if it were criminal evidence? Nope, you can't. The old problem of proving a ...
- 10.1k
4
votes
Accepted
Can a plain text email contain XSS injection?
No, plain-text email cannot contain a cross-site scripting (XSS) attack.XSS requires scripting, which even HTML email bodies* do not permit.
(*HTML attachments opened in web browsers can trigger XSS ...
- 9,428
3
votes
Why isn't there a protocol to exchange PGP keys?
PGP was designed to use a decentralized web of trust:
As time goes on, you will accumulate keys from other people that you may want to designate as trusted introducers. Everyone else will each choose ...
- 9,428
3
votes
What is the point of having SPF and DKIM set up, but having DMARC with policy=none?
First, there is a difference between having no DMARC policy and having a policy of p=none. No DMARC policy happens when there is no valid DMARC setting for the domain configured in DNS. But this case ...
- 183k
3
votes
How does ProtonMail manage search?
The above responses are out-of-date. It is now possible to search message content to easily find the email you're looking for, all without giving ProtonMail access to your messages.
To search your ...
- 131
3
votes
Accepted
How does this scam email from a seemingly legit domain work?
1. How did it pass SPF, DKIM and DMARC?
It doesn't. From the snippet you provide, SPF, DMARC and DKIM are either not present or fail. The email address has just been spoofed.
Authentication-Results: ...
- 10.8k
3
votes
Cipher suite choice on macOS on Apple Silicon
Apple has an AES engine as part of the Secure Enclave subsystem. It provides:
a boot ROM to establish a hardware root of trust, an AES engine for efficient and secure cryptographic operations, and ...
- 738
2
votes
Accepted
Company sent me a registration email with a clear text password
There is no reason to send a password in plain text. The password, once entered, should be securely hashed using a suitable password hashing function with strong salt, and the plaintext should be ...
- 7,125
2
votes
Accepted
What is the point of having SPF and DKIM set up, but having DMARC with policy=none?
DMARC does two things:
It informs you about what mail lacks verifiable SPF and DKIM (with From header alignment)
It allows you to block mail from your domain that is neither SPF-approved nor DKIM-...
- 9,428
2
votes
Accepted
Is it safe to open email links in a private window?
It may protect against certain session hijacking attacks, but if the link points to a browser exploit then it doesn't matter whether or not you're in a private window.
If you don't trust the links, ...
- 4,199
2
votes
Are e-mails that have a name slightly different from the web page legitimate e-mails?
These can sometimes be threats, but not this time. That's probably a legitimate Change.org email.
There are two related concepts here.
The first is subdomains, children of the main domain that can ...
- 9,428
2
votes
Accepted
Why isn't there a protocol to exchange PGP keys?
WKD (how it works)
WKD can be implemented in two ways. However as per draft-koch-openpgp-webkey-service-12 the advanced implementation is the preferred modus operandi.
Advanced implementation
A E-Mail ...
- 212
2
votes
Accepted
If email is an insecure medium, why are usernames and passwords sent via email (albeit in separate ones)?
It is usually a trade-off between user experience and security. How the trade-off is made depends on the actual threats. While mail can be seen as inherently insecure, it does not mean that every mail ...
- 183k
2
votes
If email is an insecure medium, why are usernames and passwords sent via email (albeit in separate ones)?
I will first describe what I have understood from your question:
For meetings you are sending username password pairs to the participants - they are used to retrieve documents
the username and the ...
- 25.6k
2
votes
SPF records and spoofing
What is happening here depends on the mail server (MTA) applying the policy. In case the address matches the result will be the same: Pass.
In case of non-match the result will be different though: ...
- 183k
2
votes
Can an HTML attachment in an email contain a virus?
Yes, HTML can indeed contain malware that causes harm to your computer and/or exfiltrates its data. (Not as much an old-school virus, but that I'm assuming you're using that term as a synonym for ...
- 9,428
2
votes
How are validation links getting triggered by a third party?
This is a known behaviour in gmail, and 94.101.43.5 seems to be associated with Google.
Google probably does this to check URLs for scammyness and malware, so they can provide more reliable spam and ...
- 12.6k
2
votes
Accepted
Who is accessing my pop3 email accounts?
You can check the list of IP ranges that Google advertises to the internet.
The list does include 209.85.128.0/17 which corresponds to all addresses between 209.85.128.0 and 209.85.255.255. So yes, ...
- 10.8k
2
votes
Accepted
Suspicious hyperlinks (all hex URLs) in e-mail
The reason it looks off is that it's a tracking link (as indicated by /track).
This is not entirely uncommon. You can sometimes see it in marketing emails, where every link is automatically rewritten ...
- 29k
Only top scored, non community-wiki answers of a minimum length are eligible