2

I had a test run against our mail server to see if the From header could be spoofed, which I expected to fail. We have SPF, DKIM, and DMARC all set up correctly, as far as I can tell. However, the following message was still delivered to Gmail:

Delivered-To: [email protected]
Received: by 2002:a4a:6f4a:0:0:0:0:0 with SMTP id i10-v6csp7502430oof;
        Tue, 28 Aug 2018 09:27:26 -0700 (PDT)
X-Google-Smtp-Source: ANB0Vdb2gL9sqUjkSSq6b8JksGiMbZvpaadOegQlnNtn5jNJ6ElcYeT1bO6sdYlQdOreTUazCdTqcfiWICU=
X-Received: by 2002:aca:2dd7:: with SMTP id t206-v6mr1995034oit.154.1535473645509;
        Tue, 28 Aug 2018 09:27:25 -0700 (PDT)
Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of [email protected] designates 192.254.121.248 as permitted sender) smtp.mailfrom="[email protected]";
       dkim=pass [email protected] header.s=smtpapi header.b=q5LRqj1g
Received-SPF: pass (google.com: domain of [email protected] designates 192.254.121.248 as permitted sender) client-ip=192.254.121.248;
Received: by 2002:aca:e48f:: with POP3 id b137-v6mf6449095oih.6;
        Tue, 28 Aug 2018 09:27:25 -0700 (PDT)
X-Gmail-Fetch-Info: [email protected] 4 mail.knextion.com 995 [email protected]
Return-Path: <[email protected]>
Delivered-To: [email protected]
Received: from paul.knextion.com by paul.knextion.com with LMTP id cFWUMs91hVvZKgAAKeyupQ for <[email protected]>; Tue, 28 Aug 2018 16:18:23 +0000
Return-path: <[email protected]>
Envelope-to: [email protected]
Delivery-date: Tue, 28 Aug 2018 16:18:23 +0000
Received: from o2.pstemail.knowbe4.com ([192.254.121.248]:8276) by paul.knextion.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.91) (envelope-from <[email protected]>) id 1fughC-0002qa-Nn for [email protected]; Tue, 28 Aug 2018 16:18:23 +0000
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=sendgrid.net; h=from:mime-version:to:content-type:subject; s=smtpapi; bh=bg0lHs+VfF3/1byBibxhl5LSVFs=; b=q5LRqj1gde0l32I1BEy1+Cj6p1gj2 mxJv6jwrtedaLsIvcj99UIewFHPRuyMAoBgSo/swR9HPvN+1qSPu/7GNd58imdnM q3aMvatNxj30CDISkvjS0XSs95WvZ6rvk188Aml3hBeRpsBPsm7nHITwop9r4c3y bVeEKV6YHxxt1I=
Received: by filter0028p3iad2.sendgrid.net with SMTP id filter0028p3iad2-9024-5B8575A3-60
        2018-08-28 16:17:40.014016575 +0000 UTC m=+930326.755523913
Received: from NjMyNzMyNQ (ec2-35-170-11-38.compute-1.amazonaws.com [35.170.11.38]) by ismtpd0001p1iad1.sendgrid.net (SG) with HTTP id _-UcpATiQ5mYDleTFM62hQ Tue, 28 Aug 2018 16:17:39.902 +0000 (UTC)
Date: Tue, 28 Aug 2018 16:17:40 +0000 (UTC)
From: [email protected]
Mime-Version: 1.0
To: [email protected]
Message-ID: <[email protected]>
Content-type: multipart/alternative; boundary="----------=_1535473060-15651-1640"
Subject: Test Email
X-SG-EID: 8K5OYQepvmN+h/LdhcHZbe/QO6KUcyHPG/zIchVj+BckwZYyPPqFXNewZ2m/rVJHhuGqH80rPI0boR v+6IjNiHfb+8JS7SvwO/vI085p32sPr1UOneuJ6jO1dBw0/wuhOsySPV6fd541QtFkKOU/RFs3bPiG jbF25PCRgPLJg0jpWGICqT3arHhUYq4aSPJxQX58HVn9SpHZdnkj5KsNxA==
X-SG-ID: ry6MXBxyEtnC+S9qPe1Pt1jDZZ1BhhEm7IkH/SKulWDtQz9/mmkpElaI9wX0Rf6V
X-Spam-Status: No, score=5.2
X-Spam-Score: 52
X-Spam-Bar: +++++
X-Ham-Report: Spam detection software, running on the system "paul.knextion.com", has NOT identified this incoming email as spam.
  The original message has been attached to this so you can view it or label similar future email.
  If you have any questions, see root\@localhost for details.
  Content preview:
  This is a test Spoof email This is a test Spoof email [...]
      Content analysis details:
   (5.2 points, 8.0 required)
   pts rule name
              description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_DNSWL_NONE
     RBL: Sender listed at http://www.dnswl.org/, no
                             trust
                             [192.254.121.248 listed in list.dnswl.org]
  0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
                             domains are different -0.0 SPF_PASS
               SPF: sender matches SPF record
  1.7 HTML_IMAGE_ONLY_08
     BODY: HTML: images with 400-800 bytes of words
  0.8 BAYES_50
               BODY: Bayes spam probability is 40 to 60%
                             [score: 0.4717]
  0.0 HTML_MESSAGE
           BODY: HTML included in message
  1.1 KAM_REALLYHUGEIMGSRC
   RAW: Spam with image tags with ridiculously huge
                              http urls -0.1 DKIM_VALID
             Message has at least one valid DKIM or DK signature
  0.1 DKIM_SIGNED
            Message has a DKIM or DK signature, not necessarily valid
  1.0 URIBL_GREY
             Contains an URL listed in the URIBL greylist
                             [URIs: sendgrid.net]
  0.5 URIBL_GOLD
             Contains an URL listed in the URIBL GOLDlist
                             [URIs: sendgrid.net]
  0.0 T_REMOTE_IMAGE
         Message contains an external image
X-Spam-Flag: NO

------------=_1535473060-15651-1640
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset=UTF-8

This is a test Spoof email
------------=_1535473060-15651-1640
Content-Type: text/html; charset="UTF-8"
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

<html><body>
<p>This is a test Spoof email</p>

<img src=3D"https://u6327325.ct.sendgrid.net/wf/open?upn=3DNrk2gJgYF-2FJNXx=
3U3HYjEEXjY9Gfjb7cox0Z4e6RjHEZt6qh0p8LoeTIXQa76HCYYj3NDi02ZXXL6LbK93JpA8Jh6=
-2FQv-2FGmvbigv62ioqwJ8g64lpiJsmGybUPYqSphC11ihdXDIx-2FPdze0-2Fl-2FjacR8VYp=
10vUfLnsNm7qfjEjvuIffEmpN9oGqYSNWwlXFoPvLhGRLIms9LP-2Bxzx6YVVfxoL7v5hzO0JNg=
MXPOTg-2BTgoOYhxskJGVdKFgrp9FOrSImbfZtOx-2BbbZn5wWUVsyg-3D-3D" alt=3D"" wid=
th=3D"1" height=3D"1" border=3D"0" style=3D"height:1px !important;width:1px=
 !important;border-width:0 !important;margin-top:0 !important;margin-bottom=
:0 !important;margin-right:0 !important;margin-left:0 !important;padding-to=
p:0 !important;padding-bottom:0 !important;padding-right:0 !important;paddi=
ng-left:0 !important;"/>
</body></html>

------------=_1535473060-15651-1640--

As you can see, envelope-from and from domains don't match, which I thought DMARC would fail and Gmail would reject. Why isn't this mail being rejected?

envelope-from: [email protected]

From: [email protected]

EDIT:

From https://techblog.exonet.nl/2017-02-03-spf-dkim-dmarc:

DMARC uses a concept which is called alignment. This checks if the header-from matches with the envelope-from (SPF) or with the d=domain (DKIM). A DMARC policy requires that either SPF and/or DKIM passes. It does not require both to pass because, if an email has been forwarded, SPF checks will probably fail but DKIM should still pass (if nothing has been altered). However, even if SPF and DKIM both pass, DMARC still fails if the alignment does not match.

2
  • Casey, do you know what the reason was in the end? Did it start rejecting after a while? Could it be that Gmail would display misalignment by showing a "via" next to the from email address, and maybe a question mark instead of a profile picture? This is how Gmail shows misalignment to end users at the moment. Jan 25, 2020 at 20:25
  • Heck if I know @CorneliusRoemer. I got so fed up with it I set our configuration correctly and let it ride. I'm sure Google and other large mail providers are skipping some of these checks in order to prevent large swaths of mail from being rejected due to bad configuration. That is my only real guess. Jan 27, 2020 at 19:21

2 Answers 2

2

Why isn't this mail being rejected?

In short: probably because customers pay reputable mail service such as Sendgrid for their ability to successfully deliver email and they are quite good at what they do...


From a technical perspective:

Sendgrid used it's own sendgrid.net domain in the EnvelopeFrom and Return-Path, which in pure SPF then makes the sendgrid.net SPF policy apply, not the the SPF policy of your own domain.

Sendgrid also adds it's own DKIM signature which, since it sets the d=sendgrid.net domain, is not validating your From: [email protected] header, but it still adds trust that the message was send via sendgrid.

When neither SPF nor DKIM fail GMail won't trigger the DMARC policy for your domain.

If you're a domain owner, you'll first need to configure SPF records and DKIM keys on all outbound email streams. DMARC relies upon these technologies to ensure signature integrity. A message that fails SPF and/or DKIM checks will trigger the DMARC policy (source: https://support.google.com/a/answer/2466580?hl=en)

4
  • Correct, SPF and DKIM are passing due to validating against sendgrid.net, but I thought part of DMARC was to also validate that envelope-from and from have matching domains? Am I incorrect, or is GMail simply not running the domain check because SPF and DKIM passed? Sep 19, 2018 at 14:24
  • See my edit for why I believe DMARC should still fail, although my source is not authoritative. Sep 19, 2018 at 14:42
  • That is correct Casey! As mentioned in my initial response, the alignment is off for this mail. You can check our article on alignment for more information. Nov 1, 2018 at 6:52
  • @HBruijn, I do believe Gmail should trigger DMARC for this mail. Even a policy 'none' should make them place a 'dmarc=result' in the "Authentication-Results" header. Therefore it does look like the example was send before the DMARC DNS record was retrieved at Google. A more recent example would be nice. Nov 1, 2018 at 6:54
2

What stands out to me from the example headers is that Google seems to have skipped the DMARC check for this specific mail. I would expect a 'dmarc=' result in the headers when Google has detected a DMARC record for your From domain, this is not there.

Your DMARC record does seem to be valid when checking it.

Is it possible you had sent this example quite soon after publishing the DMARC record? In that case Google could have used a cached "DMARC record missing" result on their end.

Do you still experience this? In that case, could you please send updated headers for a more recent example?

In addition the mail fails DMARC as you don't use an aligning DKIM signature and/or an aligning Return-Path header. Please refer to the Sendgrid documentation for more information on how to set this up in your account.

Regards,

Michiel

DMARC Analyzer

3
  • Thanks Michiel. The DMARC record had been in place for quite a while when this email came through. I have since created an Exim rule that requires the headers to match since DMARC doesn't seem to work. I can turn it off and you could try to spoof me if you were interested; I'd be glad to PM you my real email and send you the result. I know that doesn't allow things like mail lists to work, but we don't use any with the domain in question. Oct 30, 2018 at 19:15
  • Could you explain the last part of your answer, that I'm not using an aligning DKIM signature? I looked at Sendgrid Docs but didn't couldn't determine what you meant there. Oct 30, 2018 at 19:17
  • Alignment means that the DKIM domain used to sign your mail with (specified in the d= parameter of the DKIM sig) should match the domain in the 'From' header (your domain). The article I referred to explains how to setup a custom sending domain in Sendgrid. This is required to achieve 'alignment' on your mails on both SPF and DKIM (DMARC requires one of them to pass and align) Nov 1, 2018 at 6:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .