5

At a site that I manage, we send out emails for many customer domains.

Some of them have our DKIM key in DNS, some don't.

From what I can tell:

Signature verification failure does not force rejection of the message.

But is that actually the case? In the real world can I just sign EVERYTHING with our key (without doing SRS) and be happy?

3 Answers 3

4

But is that actually the case?

Yes.

In the real world can I just sign EVERYTHING with our key (without doing SRS) and be happy?

Yes. It is frequently done with no ill effect. Some MTAs aren't clever enough to sign messages with per-domain DKIM keys and can only operate as you have described, signing everything with a single key. I have personally modified two MTAs to add per-domain DKIM signing support.

Email messages often carry multiple DKIM-Signature headers as they transit the internet. It's not uncommon for an organizations MTA to DKIM sign messages and then relay them to a smarthost at their ISP that also DKIM signs the message. A recipient of that message would thus see both DKIM signatures.

TLDR;

DKIM = DomainKeys Identified Mail. When a receiver validates a DKIM signature, they are merely authenticating the identity of the messages sender. As an example, if an email message arrived bearing a DKIM-Signature header and a d=example.com property, and that DKIM signature passed validation, then the recipient can trust that the message was sent by an organization that:

  • has control of the DNS for example.com
  • was in possession of the DKIM private key for example.com
  • the message hasn't been tampered with in transit

That holds for as many DKIM-Signature headers as the message bears.

Practically nobody rejects emails based on failed DKIM signatures. Being unable to fetch the domains DKIM public key counts as a failure. A significant percentage of valid email streams have broken DKIM signatures, particularly on messages that have transited a mailing list.

DMARC doesn't change DKIM. At all. DMARC = Domain-based Message Authentication, Reporting & Conformance. DMARC is a mechanism for authenticating the sending domain of an email message, as displayed in the From header of the message. DMARC is most effective at combating phishing, as it provides email senders with a reliable means to say, "if the message's Envelope Sender is not aligned with our domain (SPF) or the From message header is not DKIM aligned with our domain, then the message was not sent by us and you should (reject|quarantine|pass) it." DMARC also provides some great reporting features for domain owners. DMARC is commonly used by organizations (banks, large email providers, etc.) that miscreants have incentives to impersonate.

DMARC is thus a policy layer atop DKIM and SPF. When DMARC is in use, it imposes additional alignment requirements upon DKIM and SPF in order to pass DMARC validation. Only DKIM signatures that pass and have a d= property that aligns with the messages From header can yield a DMARC pass result. Each DKIM key can still pass or fail DKIM validation, and the consequences are no different for DKIM before or after DMARC.

1
  • Basically the situation is that SPF and DKIM are both really bad solutions to the spam/origin problem and DMARC is used to signal that the mail is okay if either is good. And as DKIM is based on distributing the verification key over DNS which is plain text unless you have a working DNSSEC environment (changes for that are slim to none) and if the attacker can modify the DNS responses the victim server sees, the attacker can fake the DKIM signature, too, simply by using their own key instead of the real one. Jun 21, 2022 at 14:48
2

A DMARC policy can change that outcome. DMARC is the combination of SPF and DKIM which alters the disposition.

4
  • how would dmarc help if one will not be able to update NS records? I dont see much of option other than rewriting sender..
    – tike
    Jul 3, 2014 at 22:19
  • If that DKIM statement holds true, The need to rewrite the sender is limited to what the DMARC policy is. A query on their customer records will tell him how important a SRS is to do. Jul 3, 2014 at 22:23
  • pretty good explanation of DMARC here support.google.com/a/answer/2466563?hl=en Jul 4, 2014 at 4:51
  • DMARC is unlikely to alter the DKIM outcome. If one of Mikey's customer domains publishes a DMARC policy that affects mail delivery (i.e., a policy other than p=none), then that customer will either publish Mikey's DKIM key in their own DNS or publish a DKIM key of their own and sign their messages. If Mikey signs it as well, there will be two DKIM signatures and at least one will be in alignment (maybe two, if Mikey signs it with their domain name). Either way, the DMARC policy outcome will be the same. Jan 24, 2015 at 6:59
-1

1) to become permitted sender + to pass DKIM, you will require TXT records

2) and TXT/spf with your ip/domain [as spf].

Emails you sign without having actual domain with keys in there txt record will end up to junk eventually. (NOTE: this is not necessarily rejection, but reputation).

5
  • -1 TXT records with SPF info aren't required for DKIM. SPF is a different sender authentication technology. Jul 7, 2014 at 13:50
  • to pass DKIM, you will require TXT and TXT/spf with your ip/domain. [that is two requirement, spf/txt whatever you use for spf and dkim as txt]
    – tike
    Jul 7, 2014 at 13:53
  • 4
    To pass DKIM you need the public key published in DNS as a TXT record. SPF is a different, orthogonal technology. Maybe you're talking about DMARC which combines the two? Jul 7, 2014 at 14:48
  • Not true at all. Whether a message ends up in junk rarely has little to do with DKIM signatures failing, let alone having happen because a message bears an extra DKIM signature. Further, reputations can only be applied to messages when the receiver is confident of the identity of the sender. That's the whole point of SPF and DKIM is to know the identity of the sender and therefore be able to remember and apply it to future connections. W/o identity validation, spammers could impersonate legit domains to piggyback on domains with good reputations. Jan 24, 2015 at 6:45
  • @MattSimerson That's good in theory but many mail receiving organizations have misunderstood what SPF and DKIM really do and they have decided that unless the mail has valid SPF data it should bounce. And they do this to avoid spam, which is obviously stupid because spammers can just use valid SPF and DKIM. The least bad option seems to publish SPF+DKIM+DMARC and try to say that either SPF or DKIM is okay and SPF policy should never be -all instead of ~all even in that case. Jun 21, 2022 at 14:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .