1

Consider DMARC record:

v=DMARC1;p=reject;rua=mailto:xyz;ruf=mailto:xyz;adkim=s;aspf=s;pct=100;fo=1;sp=reject

Also consider domain example.com with a TXT record:

v=spf1 include:_spf.google.com -all

Now imagine a third party sends an email using FROM test@example.com by either uses an SMTP envelope with a FROM test@mail-sender.com or a return-path of test@mail-sender.com.

My understanding is that now the recipient SMTP server will validate SPF using the TXT record at mail-sender.com.

If this SPF record for mail-sender.com either:

  • Does not exist
  • Is syntactically invalid
  • Permits any IP to send

My understanding is that the SPF TXT record for example.com is totally ignored and the DMARC record which "rejects" and is in strict SPF alignment mode would not prevent these messages from being delivered successfully (I think these are considered a non aligned SPF pass).

Essentially, am I right to say that there is no such thing in SPF & DMARC to say "only emails from IP's explicitly listed in the TXT record of example.com are allowed to send on behalf of my domain".

1

I think you're mainly missing the 'alignment' which is required to get a DMARC compliant mail. This is what differentiates DMARC from the existing techniques.

Alignment means that DMARC requires you to setup authentication (SPF/DKIM) using the same* domain as the "From" domain. You mentioned alignment between the SPF domain (Envelope From) and the DKIM domain, however this does not apply.

In your example the messages would not be DMARC compliant as there is no alignment on the @example.com 'From' domain and the @mail-sender.com 'Return-Path' domain. This example would generate an SPF "Pass", however a DMARC "Fail".

The statement about SPF & DMARC is exactly what DMARC is about: making sure the authentication is actually done using the 'From' domain in question instead of a @mail-sender.com domain.

Does this help you?

Regards,

Michiel

DMARC Analyzer

  • thanks for the feedback. The strange thing is, we use intercom for sending mail and they do not supply us with an SPF record. In gmail "view original" these messages are marked as SPF PASS and DMARC PASS. Our DMARC policy is as per this post. Our SPF record doesn't permit intercom. Their page (intercom.com/help/configure-intercom-for-your-product-or-site/…) says don't worry about SPF, we take care of it in the return path. Doesn't this mean that even in strict SPF mode it can be totally bypassed. – David Oct 12 '18 at 10:33
  • If you like i'd be prepared to share the entire headers of the message and how they appear in my dmarcanalyzer.com account. – David Oct 12 '18 at 10:34
  • This is what intercom's support team told me about this: "SPF alignment won't happen because of the way that return are handled. We do hope to enable custom CNAME's in the future to define your own return paths, but it's not set up that way currently. Again, something the team is looking in to for down the road to reach full alignment! SPF authentications will still pass, and DMARC will pass based on DKIM passing as well though." – David Oct 12 '18 at 10:36
  • It is indeed possible senders only support DKIM alignment. This does not have to be an issue as DKIM is the preferred auth method to achieve DMARC compliance. So setting up DKIM will suffice for this flow – DMARC Analyzer - Michiel Oct 13 '18 at 13:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.