15

Is there a way to enforce DMARC to fail/reject mail that doesn't pass BOTH DKIM and SPF?

We have been narrowing the number that are failing, but there are some domains in our aggregate (rua) report that are passing just DKIM and we would rather that they fail our DMARC because we don't recognize them.

The domains that we do recognize are fully-aligned.

Our end goal is that unless it is fully aligned (both DKIM AND SPF), the message will be rejected

Improve this question
0

3 Answers 3

Reset to default
8

Under the basic assumptions underpinning DMARC, nobody should be able to pass either a DKIM or SPF test as your domain, unless the mail is coming from a server you control. A pass for either of the two is enough to confirm this.

Thus there is no way to force DMARC to require both pass, and there should be no reason to do so.

If third parties are able to pass DKIM tests as you, and you did not authorise them, then you have a security problem, and this is what you need to fix.

First, make sure you haven't just made a mistake interpreting the reports you are seeing. Are they DKIM signed, but with a domain that's not yours? If so, there's nothing you need to do. But if emails not authorised by you are DKIM signed with your domain, this indicates you're doing something wrong.

Steps to take:

  • Generate a new DKIM key, start signing with it, and remove references to the old key from your DNS records (leaving the old DNS records will allow the old key to continue to be used).

  • Keep the private part of your DKIM key secure. By default, it should be hidden to all except root on your server. Keep it this way.

  • Make sure you are not signing mail that is coming in from untrusted sources. You should be only adding DKIM signatures to mail that originates with you and your users.

    If using OpenDKIM this is controlled by the InternalHosts option, and you should also make sure that you are not re-running OpenDKIM after passing mail through a local filter or proxy which would make it look like the mail originated internally.

Improve this answer
9
  • 2
    It may be useful to enforce both (or especially enforce DKIM) if IP address is shared (f.ex. e-mail providers using the same IP address for multiple clients). Alternative would be to not configure SPF, but that may impact e-mail deliverability if a SPAM checker incorporates an SPF check to guess if the sender is legitimate. So, this seems to me a flow in the DMARC infrastructure. Even large e-mail providers (such as Microsoft) seems to be impacted as they typically include the same spf records for all clients, i.e. include:spf.protection.outlook.com.
    – m7913d
    Commented Oct 27, 2022 at 12:10
  • 1
    SPF and DKIM are set up at the level of the authoritative dns server for the domain. It doesn't matter who's using what IP address or how many clients are using a server, it's who has control over the domain that gets to say which outgoing servers are authorised. You haven't provided reasoning for why you would need to enforce both DKIM and SPF to ensure the server is genuine. Any time either an SPF or DKIM check succeeds, it confirms that the entity in control over the domain name has given authorisation to that mail server to be a sending server for that domain.
    – thomasrutter
    Commented Oct 28, 2022 at 0:50
  • If you're thinking about scenarios where you are sending through a mail server (eg a relay) that you don't trust to be a good player, that's a problematic situation for mail delivery in general, and not really compatible with modern email or with SPF or DKIM. You shouldn't SPF or DKIM-authorise a mail server that you don't trust to be a good player (nor even use it at all, really) but it'll be your own reputation that you'll be affecting should it start sending out spam/malware in your name.
    – thomasrutter
    Commented Oct 28, 2022 at 0:54
  • Using a relay (such as those from your internet provider or bulk sending services such as MailChimp) or cloud mail service (such as Google Workspace or Microsoft 365) is indeed the scenario I mean. I think all of them at least try to be "good players", but they are using the same IP for multiple clients. I'm not sure how well all those services check whether there client is a legitimate sender for the specified FROM address. It's not easy to verify whether they perform the job well in all cases. Even a single compromised IP address (those services often use a large pool) is enough.
    – m7913d
    Commented Oct 28, 2022 at 8:04
  • 1
    A service like mailchimp would presumably not let other accounts send as your domain so assuming this, they should be fine to set up for SPF and DKIM. They'll try and keep their IP's reputation good while you look after your domain's reputation.
    – thomasrutter
    Commented Oct 29, 2022 at 13:04
5

DMARC is working as designed; if at least one of SPF or DKIM passes (and is aligned), the message passes DMARC and is delivered. Most likely, the messages that are failing SPF but passing DKIM (signature valid and aligned) are messages that have been forwarded. (Forwarded messages will fail SPF, while a DKIM signature can survive forwarding.)

Improve this answer
1
  • 1
    True. SPF is a very unreliable mechanism (due to widespread practice of forwarding), thus SPF is only a fallback to partially cover occassional DKIM failures.
    – kubanczyk
    Commented Oct 8, 2018 at 20:27
2

No, DMARC is designed to only require either DKIM + ADKIM or SPF + ASPF to pass.

There is no requirement to make it require both.

I find it hard to understand how DKIM passes the alignment test, if the d= key doesn't match the from then it will fail the ADKIM test.

Take a look on how the identifiers must match up here: DMARC Email Identifiers

Even if you didn't specify adkim in your DMARC record, it's defaulted to "Relaxed" which still wouldn't line up.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .