1

I run a web service that should be able to send out e-mails using a company address, e.g. foo@company.com. I do not, however, want to give this service access to the mail server of company.com (for security reasons) and instead want to send the e-mails from another server (e.g. foo.com)

I my understanding, I can achieve this by adding SPF / DKIM records to the DNS configuration of company.com, mentioning foo.com as a valid domain for sending e-mail as .....@company.com.

The potential problem I see with this (as far as I understand DKIM / SPF) is that if my foo.com mail server gets hacked it will be able to send validated e-mail for all addresses in the ........@company.com domain (e.g. from ceo@company.com), which is of course not acceptable.

My question:

Is there a way to specify the SPF / DKIM records such that only a single e-mail address (foo@company.com) is allowed to send mail via foo.com?

I read that DKIM supports selectors which might be up to that task, but I could not find any information about which types of selectors are accepted/understood by e-mail servers, so I'm unsure if this would be the right strategy to implement this.

Of course I'm also open to alternative solutions for making sure that my service is able to send validated e-mails as foo@company.com while not being able to impersonate any other e-mail account in case it gets compromised.

3

There is no way to specify an individual email address with either DKIM or SPF.

Recommended solutions:

  • For low volumes have them connect to your mail server on the Submission port (587) and authenticate before sending. This is likely suitable for your situation.
  • For larger volumes (marketing mail, mailing lists), create a dedicated sub-domain. Configure SPF and DKIM for this sub-domain.

In either case, make sure the sending address is a suitable addresses.

  • Thanks for proposing this solution, I was thinking to use a subdomain for the task as well, as giving access to the mail server will probably not be possible. Are you sure there is no way to do this via SPF / DKIM? – ThePhysicist Jun 21 '16 at 13:44
  • @ThePhysicist SPF and DKIM both specify data in DNS for the Domain, and have no concept of individual email addresses at this level. You could add the Web server to SPF or add a separate DKIM selector, but these would work far any email address in the domain. Even the solutions I recommended don't restrict access to a single userid. – BillThor Jun 22 '16 at 1:43
1

Let's break this down a little farther. I can send emails from ceo@yourcompany.com, all that's going to happen based on your SPF setting is that it's going to either "Fail it", "Softfail It", or treat it as a "Neutral" email based on your SPF Setting of -all,~all, ?all. I still sent the email as ceo@yourcompany.com, it might land in the inbox, it might land in the spam folder. It really depends on the filter of the receiving person's email server.

Since this didn't solve the issue, they came up with DMARC this standard when enforced by the receiving mail server, will actually reject the email if SPF Record and DKIM both fails and send you a report when this happens. This is your only true protection.

Assuming you set up DMARC, because without it, your web service is really no different then me sending emails directly pretending to be you.

You can then add the SPF record to allow your web service to send the email.

Now you're concerned about your Web Service being hacked, but how is that different from your company's main email server being hacked? If they hack your webservice, what's stops them from hacking your DNS records and changing the SPF?

I'm all about mitigating risks, but in reality, if it's tested for vulnerabilities, you follow all the protocols for securing a web service. I think your chances to be targeted will be low.

  • thanks for breaking this down, the thing is that the company's main email server can be protected more efficiently from access through the Internet (e.g. by requiring a VPN connection to access it), while the web server is directly exposed to the web. Hence opening a channel from that server to the internal mail server would render the whole system more vulnerable. – ThePhysicist Jun 22 '16 at 8:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.