Hacker News Reader

Comment by warner25 | Hacker News Reader

Question for the experts, as I haven't yet seen a good explanation of this: Why are both SPF and DKIM required to prevent fraudulent emails? My semi-naive intuition is that maybe SPF alone is not sufficient, because of IP address spoofing, but DKIM alone should be sufficient if mail servers adequately protect their private keys. Does SPF just help in the cases where private keys are stolen? Maybe something about DNS cache poisoning, since that's where recipients get the DKIM public keys?

View on HN

Most of confusion with email authentication historically came from two things: SMTP envelope address might not be equal to content From: address, and there was no clear policy whether to expect DKIM signature, or to which address apply SPF check.

SPF is enough to prevent spoofed source of SMTP envelope, but not for From: spoofing. (applying it to From: address would reject any forwarded mail, which probably isn't desired)

DKIM ensures legitimacy of From: address, and works correctly with forwarding. But DKIM itself doesn't specify whether you should require DKIM signature. (ADSP record allows to specify that, but it wasn't deployed nearly at all)

DMARC record is used to specify unambiguous policy, and it passes when either SPF is aligned with From: address, or there's valid DKIM signature. Thus DKIM+DMARC is enough to prevent spoofed mail, but SPF is usually kept in case some servers still don't support newer methods. SPF+DMARC would also prevent spoofing, but will also reject forwarded mail.

Note that SPF+DKIM without DMARC doesn't really protect against spoofing, because SPF checks only envelope address, and you cannot tell whether DKIM signature is required.

spf : the receiving server can check (in a public dns record) which server is allowed to send for this domain

dkim : the email is signed (using a private key) with a unique signature, the receiving server can validate the DKIM signature by running a DNS query to search for the public key for that domain .

dmarc : publish a policy on how emails that does not satisfy the above condition above (spf & dkim) should be handled (quarantine, reject) and optionally sends you a report on who send/tried to send emails on the behalf of your domain

Edit : I misread your question... it is odd indeed that only satisfying one condition is enough for a pass...

I would add that SPF alone may not be enough, and that's why some of the other mechanisms are needed. AFAIK if you have a softfail SPF (a record ending in `~`), you would need DMARC or DKIM. But the SPF is needed always in order to specify the domains/ip that are allowed. The other two mechanisms are used for making it more strong and reducing the potential phishing attacks. In particular, a softfail SPF may be fixed by using a "rejected" or "quarantine" DMARC policy.

But this is from the RFC document, so it may be that in practical cases things are more nuanced.

what is the consequence if i set my dmarc to reject? i'm afraid

Then E-Mails which fail the SPF and DKIM checks should be rejected by the receiving server. Many mailservers still let them through though because they just don't check dmarc or put them in a spam folder or quarantine.

Where does it say that? As per rfc7489 4.2:

A message satisfies the DMARC checks if at least one of the supported authentication mechanisms:

   1.  produces a "pass" result

Personally I did not test yet what a DMARC result 1 fully failing check produces. I can say however that only 1 successful identifier-alignment criteria (and the other credential being valid but not aligned) is enough for an overall pass.

Of course the receiving mailserver is free to enforce a strict DKIM&SPF requirement aside the DMARC check/spec. If your question is why that would be necessary, I'd love to hear the reason aswell

As mentioned above, I think it is due to the fact that SPF may be too broad, as in softfail SPF (defined here https://datatracker.ietf.org/doc/html/rfc7208#section-2.6.5).

Based on the RFC, for the rest of possible SPF configurations (more strict), SPF record would be enough. But I am guessing based on the RFC document and my experience.

I think part of it is that the presence of either is sufficient to validate a sender, but the absence of either doesn't tell you much, because there are multiple valid reasons either could be missing from a valid sender.

Reply on news.ycombinator.com