8 ms·

The reason for this is right in the headers. The message had a valid ARC headers used to preserve DKIM/SPF/DMARC checks when forwarding email. https://en.wikip

The reason for this is right in the headers. The message had a valid ARC headers used to preserve DKIM/SPF/DMARC checks when forwarding email. https://en.wikipedia.org/wiki/Authenticated_Received_Chain https://en.wikipedia.org/wiki/Authenticated_Received_Chain

jeffbee 4y ago
Correct, this message isn't forged, it's authentic. You can check the signature yourself.
- gouggoug 4y ago
  > Correct, this message isn't forged, it's authentic I personally receive a lot of emails that aren't addressed to me and aren't marked as spam and have always wondered how this works. Can someone go into a bit more details about why this works? In what way is this message authentic? The ARC wiki page says "Validating an ARC chain only makes sense if the receiver trusts the ARC signers."; in this case the receiver is Gmail. Why does gmail trust a random domain (robtoledoyour.com)?
  - colbertw08 4y ago
    Yes I would love to know why this works as well. I've noticed over the past few months, I get emails that land in my gmail inbox that are obviously spam (various bs offers), and I've always wondered how they are able to bypass the spam filter with ease it seems. Also the To email line is to an email address that is a variation of my email address @aol.com that doesn't actually exist
    - XorNot 4y ago
      The latest thing that started happening a week or two ago was an endless stream of unsolicited mailing list messages addressed to "Prunella" trying to get me to click on links. Ended up just setting up an autodelete when that name is in the Send field (because I discovered Gmail doesn't let you auto-spam folder things).
  - donmcronald 4y ago
    I think it’s because YouTube.com is the original sender and it’s considered ok if the receiver trusts the signers. The problem IMO is that the receiver’s mail provider (ex: ms365) doesn’t know if the receiver trusts the signers when deciding to deliver messages. I’ve seen bad actors flood mailboxes with forwarded mail to obfuscate malicious activity. For example, they send a forged message asking for banking info updates and flood the real address that’ll get the “ok done” reply which I assume is an attempt to delay discovery of the attack.
  - jeffbee 4y ago
    The envelope recipient - the account to which the message is delivered - hasn't got anything at all to do with the contents of the "To:" header, which can be absolutely anything. That's how the "Bcc" feature of email works! The "To:" header is not involved in any way with the delivery of emails.
- bocytron 4y ago
  Then why was it addressed to "alltimecaptaincool2019@gmail.com" and why was it sent from postalerts@robtoledoyour.com ?
  - jeffbee 4y ago
    The reason that message has that addressee is because the To: is protected by the DKIM signature, so whoever relayed the message cannot have changed it.
kazinator 4y ago
... "In fact, an ARC chain can be counterfeited,[3] so ARC processing applies when receivers trust the good faith of ARC signers, but not so much their filtering practices." Hmm, article references an e-mail post by good old John Levine, moderator of comp.compilers for over 30 years, who has some interesting things to say: "[If] I were a certain kind of bad guy, I would take the two seal ARC chain from a message from a virtuous sender, replace the message body and >From and Subject line with my spam, add a fresh new i=3 seal and blast it out. That ARC chain is 100% valid, even though the messsage is spam."
- jeffbee 4y ago
  You're implying that this message has been tampered with, but it has not. It is perfectly authentic. Whoever produced this message possesses the private signing key of youtube.com. This message has in no way been forged. The only mystery here is why someone is mirroring google mail back to gmail with unexpected envelope recipients. It could be a weird error, or it could be they think they can game the IP reputation system by doing it. In any case, the fine moderators ought to correct the title, because it is wrong and misleading.
  - jmillikin 4y ago
    The message has been forged, as can be observed from the From: header being a domain that the sending server was not authorized to send from. Whether a subset of the message -- in this case the body -- is authentic doesn't matter. If I were to MITM google.com and send back an archived snapshot from a month ago, that would be forged traffic even if it matches responses that Google had once sent.
    - jeffbee 4y ago
      With all due respect, you don’t know what you’re talking about. Relaying month-old traffic is completely acceptable in email.
      - azca 4y ago

jeffbee 4y ago

Correct, this message isn't forged, it's authentic. You can check the signature yourself.

gouggoug 4y ago
> Correct, this message isn't forged, it's authentic I personally receive a lot of emails that aren't addressed to me and aren't marked as spam and have always wondered how this works. Can someone go into a bit more details about why this works? In what way is this message authentic? The ARC wiki page says "Validating an ARC chain only makes sense if the receiver trusts the ARC signers."; in this case the receiver is Gmail. Why does gmail trust a random domain (robtoledoyour.com)?
- colbertw08 4y ago
  Yes I would love to know why this works as well. I've noticed over the past few months, I get emails that land in my gmail inbox that are obviously spam (various bs offers), and I've always wondered how they are able to bypass the spam filter with ease it seems. Also the To email line is to an email address that is a variation of my email address @aol.com that doesn't actually exist
  - XorNot 4y ago
    The latest thing that started happening a week or two ago was an endless stream of unsolicited mailing list messages addressed to "Prunella" trying to get me to click on links. Ended up just setting up an autodelete when that name is in the Send field (because I discovered Gmail doesn't let you auto-spam folder things).
- donmcronald 4y ago
  I think it’s because YouTube.com is the original sender and it’s considered ok if the receiver trusts the signers. The problem IMO is that the receiver’s mail provider (ex: ms365) doesn’t know if the receiver trusts the signers when deciding to deliver messages. I’ve seen bad actors flood mailboxes with forwarded mail to obfuscate malicious activity. For example, they send a forged message asking for banking info updates and flood the real address that’ll get the “ok done” reply which I assume is an attempt to delay discovery of the attack.
- jeffbee 4y ago
  The envelope recipient - the account to which the message is delivered - hasn't got anything at all to do with the contents of the "To:" header, which can be absolutely anything. That's how the "Bcc" feature of email works! The "To:" header is not involved in any way with the delivery of emails.
bocytron 4y ago
Then why was it addressed to "alltimecaptaincool2019@gmail.com" and why was it sent from postalerts@robtoledoyour.com ?
- jeffbee 4y ago
  The reason that message has that addressee is because the To: is protected by the DKIM signature, so whoever relayed the message cannot have changed it.

kazinator 4y ago

... "In fact, an ARC chain can be counterfeited,[3] so ARC processing applies when receivers trust the good faith of ARC signers, but not so much their filtering practices." Hmm, article references an e-mail post by good old John Levine, moderator of comp.compilers for over 30 years, who has some interesting things to say: "[If] I were a certain kind of bad guy, I would take the two seal ARC chain from a message from a virtuous sender, replace the message body and >From and Subject line with my spam, add a fresh new i=3 seal and blast it out. That ARC chain is 100% valid, even though the messsage is spam."

jeffbee 4y ago
You're implying that this message has been tampered with, but it has not. It is perfectly authentic. Whoever produced this message possesses the private signing key of youtube.com. This message has in no way been forged. The only mystery here is why someone is mirroring google mail back to gmail with unexpected envelope recipients. It could be a weird error, or it could be they think they can game the IP reputation system by doing it. In any case, the fine moderators ought to correct the title, because it is wrong and misleading.
- jmillikin 4y ago
  The message has been forged, as can be observed from the From: header being a domain that the sending server was not authorized to send from. Whether a subset of the message -- in this case the body -- is authentic doesn't matter. If I were to MITM google.com and send back an archived snapshot from a month ago, that would be forged traffic even if it matches responses that Google had once sent.
  - jeffbee 4y ago
    With all due respect, you don’t know what you’re talking about. Relaying month-old traffic is completely acceptable in email.
    - azca 4y ago