7 ms·
The very next sentence in parent comment details the problem.
by function_seven 3y ago
The very next sentence in parent comment details the problem.
- upofadown 3y agoThe next sentence: >As a result, an attacker can create a spoofed email–an email with a fake identity–pretending, for example, to come from the Department of State--and then forward it through their personal Outlook account. That contains the incorrect assumption, that DKIM/SPF is intended and can be used as sender verification. Yes, if the DMARC policy can be and is set to "reject", if the receiving email server actually pays any attention to the DMARC policy, and the server only sends mail for one domain then you will make things harder for those spoofing emails. But DKIM/SPF has only ever been about server reputation. Retconing it without some sort of broad consensus is only going to lead to trouble down the way.
- hedora 3y agoSo, the problem is that DKIM/SPF doesn’t check end-to-end invariants, and instead checks a property that few end-users understand, and that zero end-users care about.
- peanut-walrus 3y agoThe problem here is that Department of State has set their DMARC policy correctly to reject and the victim is using a server that correctly checks the policy, so sender spoofing should not be possible. However, the Outlook server in between launders the email by 1) not honoring the DMARC policy and 2) rewriting the email headers to originate from Department of State. As DMARC requires that either SPF or DKIM alignment passes, the laundered email will pass the DMARC check on the victim's side who expects to be protected from this kind of spoofing. Really the solution here should be an extension to DMARC where you can set a policy that BOTH SPF and DKIM checks need to pass and be aligned in order for the email to be delivered, rather than just one.