2

I had a test run against our mail server to see if the From header could be spoofed, which I expected to fail. We have SPF, DKIM, and DMARC all set up correctly, as far as I can tell. However, the following message was still delivered to Gmail:

Delivered-To: user@gmail.com
Received: by 2002:a4a:6f4a:0:0:0:0:0 with SMTP id i10-v6csp7502430oof;
        Tue, 28 Aug 2018 09:27:26 -0700 (PDT)
X-Google-Smtp-Source: ANB0Vdb2gL9sqUjkSSq6b8JksGiMbZvpaadOegQlnNtn5jNJ6ElcYeT1bO6sdYlQdOreTUazCdTqcfiWICU=
X-Received: by 2002:aca:2dd7:: with SMTP id t206-v6mr1995034oit.154.1535473645509;
        Tue, 28 Aug 2018 09:27:25 -0700 (PDT)
Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of bounces+6327325-a094-user=knextion.com@sendgrid.net designates 192.254.121.248 as permitted sender) smtp.mailfrom="bounces+6327325-a094-user=knextion.com@sendgrid.net";
       dkim=pass header.i=@sendgrid.net header.s=smtpapi header.b=q5LRqj1g
Received-SPF: pass (google.com: domain of bounces+6327325-a094-user=knextion.com@sendgrid.net designates 192.254.121.248 as permitted sender) client-ip=192.254.121.248;
Received: by 2002:aca:e48f:: with POP3 id b137-v6mf6449095oih.6;
        Tue, 28 Aug 2018 09:27:25 -0700 (PDT)
X-Gmail-Fetch-Info: user@knextion.com 4 mail.knextion.com 995 user@knextion.com
Return-Path: <bounces+6327325-a094-user=knextion.com@sendgrid.net>
Delivered-To: user@knextion.com
Received: from paul.knextion.com by paul.knextion.com with LMTP id cFWUMs91hVvZKgAAKeyupQ for <user@knextion.com>; Tue, 28 Aug 2018 16:18:23 +0000
Return-path: <bounces+6327325-a094-user=knextion.com@sendgrid.net>
Envelope-to: user@knextion.com
Delivery-date: Tue, 28 Aug 2018 16:18:23 +0000
Received: from o2.pstemail.knowbe4.com ([192.254.121.248]:8276) by paul.knextion.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.91) (envelope-from <bounces+6327325-a094-user=knextion.com@sendgrid.net>) id 1fughC-0002qa-Nn for user@knextion.com; Tue, 28 Aug 2018 16:18:23 +0000
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=sendgrid.net; h=from:mime-version:to:content-type:subject; s=smtpapi; bh=bg0lHs+VfF3/1byBibxhl5LSVFs=; b=q5LRqj1gde0l32I1BEy1+Cj6p1gj2 mxJv6jwrtedaLsIvcj99UIewFHPRuyMAoBgSo/swR9HPvN+1qSPu/7GNd58imdnM q3aMvatNxj30CDISkvjS0XSs95WvZ6rvk188Aml3hBeRpsBPsm7nHITwop9r4c3y bVeEKV6YHxxt1I=
Received: by filter0028p3iad2.sendgrid.net with SMTP id filter0028p3iad2-9024-5B8575A3-60
        2018-08-28 16:17:40.014016575 +0000 UTC m=+930326.755523913
Received: from NjMyNzMyNQ (ec2-35-170-11-38.compute-1.amazonaws.com [35.170.11.38]) by ismtpd0001p1iad1.sendgrid.net (SG) with HTTP id _-UcpATiQ5mYDleTFM62hQ Tue, 28 Aug 2018 16:17:39.902 +0000 (UTC)
Date: Tue, 28 Aug 2018 16:17:40 +0000 (UTC)
From: user@knextion.com
Mime-Version: 1.0
To: user@knextion.com
Message-ID: <_-UcpATiQ5mYDleTFM62hQ@ismtpd0001p1iad1.sendgrid.net>
Content-type: multipart/alternative; boundary="----------=_1535473060-15651-1640"
Subject: Test Email
X-SG-EID: 8K5OYQepvmN+h/LdhcHZbe/QO6KUcyHPG/zIchVj+BckwZYyPPqFXNewZ2m/rVJHhuGqH80rPI0boR v+6IjNiHfb+8JS7SvwO/vI085p32sPr1UOneuJ6jO1dBw0/wuhOsySPV6fd541QtFkKOU/RFs3bPiG jbF25PCRgPLJg0jpWGICqT3arHhUYq4aSPJxQX58HVn9SpHZdnkj5KsNxA==
X-SG-ID: ry6MXBxyEtnC+S9qPe1Pt1jDZZ1BhhEm7IkH/SKulWDtQz9/mmkpElaI9wX0Rf6V
X-Spam-Status: No, score=5.2
X-Spam-Score: 52
X-Spam-Bar: +++++
X-Ham-Report: Spam detection software, running on the system "paul.knextion.com", has NOT identified this incoming email as spam.
  The original message has been attached to this so you can view it or label similar future email.
  If you have any questions, see root\@localhost for details.
  Content preview:
  This is a test Spoof email This is a test Spoof email [...]
      Content analysis details:
   (5.2 points, 8.0 required)
   pts rule name
              description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_DNSWL_NONE
     RBL: Sender listed at http://www.dnswl.org/, no
                             trust
                             [192.254.121.248 listed in list.dnswl.org]
  0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
                             domains are different -0.0 SPF_PASS
               SPF: sender matches SPF record
  1.7 HTML_IMAGE_ONLY_08
     BODY: HTML: images with 400-800 bytes of words
  0.8 BAYES_50
               BODY: Bayes spam probability is 40 to 60%
                             [score: 0.4717]
  0.0 HTML_MESSAGE
           BODY: HTML included in message
  1.1 KAM_REALLYHUGEIMGSRC
   RAW: Spam with image tags with ridiculously huge
                              http urls -0.1 DKIM_VALID
             Message has at least one valid DKIM or DK signature
  0.1 DKIM_SIGNED
            Message has a DKIM or DK signature, not necessarily valid
  1.0 URIBL_GREY
             Contains an URL listed in the URIBL greylist
                             [URIs: sendgrid.net]
  0.5 URIBL_GOLD
             Contains an URL listed in the URIBL GOLDlist
                             [URIs: sendgrid.net]
  0.0 T_REMOTE_IMAGE
         Message contains an external image
X-Spam-Flag: NO

------------=_1535473060-15651-1640
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset=UTF-8

This is a test Spoof email
------------=_1535473060-15651-1640
Content-Type: text/html; charset="UTF-8"
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

<html><body>
<p>This is a test Spoof email</p>

<img src=3D"https://u6327325.ct.sendgrid.net/wf/open?upn=3DNrk2gJgYF-2FJNXx=
3U3HYjEEXjY9Gfjb7cox0Z4e6RjHEZt6qh0p8LoeTIXQa76HCYYj3NDi02ZXXL6LbK93JpA8Jh6=
-2FQv-2FGmvbigv62ioqwJ8g64lpiJsmGybUPYqSphC11ihdXDIx-2FPdze0-2Fl-2FjacR8VYp=
10vUfLnsNm7qfjEjvuIffEmpN9oGqYSNWwlXFoPvLhGRLIms9LP-2Bxzx6YVVfxoL7v5hzO0JNg=
MXPOTg-2BTgoOYhxskJGVdKFgrp9FOrSImbfZtOx-2BbbZn5wWUVsyg-3D-3D" alt=3D"" wid=
th=3D"1" height=3D"1" border=3D"0" style=3D"height:1px !important;width:1px=
 !important;border-width:0 !important;margin-top:0 !important;margin-bottom=
:0 !important;margin-right:0 !important;margin-left:0 !important;padding-to=
p:0 !important;padding-bottom:0 !important;padding-right:0 !important;paddi=
ng-left:0 !important;"/>
</body></html>

------------=_1535473060-15651-1640--

As you can see, envelope-from and from domains don't match, which I thought DMARC would fail and Gmail would reject. Why isn't this mail being rejected?

envelope-from: bounces+6327325-a094-user=knextion.com@sendgrid.net

From: user@knextion.com

EDIT:

From https://techblog.exonet.nl/2017-02-03-spf-dkim-dmarc:

DMARC uses a concept which is called alignment. This checks if the header-from matches with the envelope-from (SPF) or with the d=domain (DKIM). A DMARC policy requires that either SPF and/or DKIM passes. It does not require both to pass because, if an email has been forwarded, SPF checks will probably fail but DKIM should still pass (if nothing has been altered). However, even if SPF and DKIM both pass, DMARC still fails if the alignment does not match.

2

Why isn't this mail being rejected?

In short: probably because customers pay reputable mail service such as Sendgrid for their ability to successfully deliver email and they are quite good at what they do...


From a technical perspective:

Sendgrid used it's own sendgrid.net domain in the EnvelopeFrom and Return-Path, which in pure SPF then makes the sendgrid.net SPF policy apply, not the the SPF policy of your own domain.

Sendgrid also adds it's own DKIM signature which, since it sets the d=sendgrid.net domain, is not validating your From: user@knextion.com header, but it still adds trust that the message was send via sendgrid.

When neither SPF nor DKIM fail GMail won't trigger the DMARC policy for your domain.

If you're a domain owner, you'll first need to configure SPF records and DKIM keys on all outbound email streams. DMARC relies upon these technologies to ensure signature integrity. A message that fails SPF and/or DKIM checks will trigger the DMARC policy (source: https://support.google.com/a/answer/2466580?hl=en)

  • Correct, SPF and DKIM are passing due to validating against sendgrid.net, but I thought part of DMARC was to also validate that envelope-from and from have matching domains? Am I incorrect, or is GMail simply not running the domain check because SPF and DKIM passed? – Casey Wilkins Sep 19 '18 at 14:24
  • See my edit for why I believe DMARC should still fail, although my source is not authoritative. – Casey Wilkins Sep 19 '18 at 14:42
  • That is correct Casey! As mentioned in my initial response, the alignment is off for this mail. You can check our article on alignment for more information. – DMARC Analyzer - Michiel Nov 1 '18 at 6:52
  • @HBruijn, I do believe Gmail should trigger DMARC for this mail. Even a policy 'none' should make them place a 'dmarc=result' in the "Authentication-Results" header. Therefore it does look like the example was send before the DMARC DNS record was retrieved at Google. A more recent example would be nice. – DMARC Analyzer - Michiel Nov 1 '18 at 6:54
2

What stands out to me from the example headers is that Google seems to have skipped the DMARC check for this specific mail. I would expect a 'dmarc=' result in the headers when Google has detected a DMARC record for your From domain, this is not there.

Your DMARC record does seem to be valid when checking it.

Is it possible you had sent this example quite soon after publishing the DMARC record? In that case Google could have used a cached "DMARC record missing" result on their end.

Do you still experience this? In that case, could you please send updated headers for a more recent example?

In addition the mail fails DMARC as you don't use an aligning DKIM signature and/or an aligning Return-Path header. Please refer to the Sendgrid documentation for more information on how to set this up in your account.

Regards,

Michiel

DMARC Analyzer

  • Thanks Michiel. The DMARC record had been in place for quite a while when this email came through. I have since created an Exim rule that requires the headers to match since DMARC doesn't seem to work. I can turn it off and you could try to spoof me if you were interested; I'd be glad to PM you my real email and send you the result. I know that doesn't allow things like mail lists to work, but we don't use any with the domain in question. – Casey Wilkins Oct 30 '18 at 19:15
  • Could you explain the last part of your answer, that I'm not using an aligning DKIM signature? I looked at Sendgrid Docs but didn't couldn't determine what you meant there. – Casey Wilkins Oct 30 '18 at 19:17
  • Alignment means that the DKIM domain used to sign your mail with (specified in the d= parameter of the DKIM sig) should match the domain in the 'From' header (your domain). The article I referred to explains how to setup a custom sending domain in Sendgrid. This is required to achieve 'alignment' on your mails on both SPF and DKIM (DMARC requires one of them to pass and align) – DMARC Analyzer - Michiel Nov 1 '18 at 6:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.