K. Ryabitsev
monsieuricon
DKIM and DMARC were not created to combat email spam, they were created to combat phishing. In fact, it is very easy for spammers to send DMARC-compliant mail via a spammer botnet, with a valid DKIM signature from Gmail (or any other large provider):
1. a spammer registers an account at gmail.com and sends a single spammy message to another Gmail account they control
2. they download that message, with all the headers, from their other account
3. they then send this same unaltered message to thousands of addresses via their spam botnet using a different envelope-from domain that has valid SPF entries matching the botnet
4. The spam email arrives 100% DMARC-compliant, because the SPF records matched the envelope-from domain and the DKIM signature matched gmail.com in the From: header
Google is fully aware of this, but they can't do anything to stop spammers from using this scheme -- at least not yet. They are pushing for "Replay-Resistant ARC" (https://datatracker.ietf.org/doc/draft-chuang-replay-resistant-arc/), which is why you will see a "darn=" header in the DKIM signature you get from gmail. However, even if they succeed in getting it adopted, we're still easily years away from it making any kind of impact on spam.
0
10
17
Freddie Leeman
freddieleeman@infosec.exchange@steve @monsieuricon DKIM itself isn't directly related to spam filtering. DKIM's role is to allow a domain to assert responsibility for an email, ensuring the message hasn't been altered in transit. DMARC is a powerful tool when it checks for alignment between the DKIM domain and the RFC5322.From domain. This alignment is what adds significant value to email authentication.
Enforcing a DMARC policy can be especially effective in mitigating spear phishing attacks. With DMARC, emails from unauthorized sources are less likely to be delivered to recipients' inboxes, thereby enhancing security.
Regarding brand protection, the importance is straightforward. If a malicious party exploits your domain in the absence of enforced DMARC, it not only risks your brand's reputation but also exposes users to potential scams, with your brand's domain visible on such emails. This can indeed harm your brand's image, as it may be perceived as negligent in terms of security.
In conclusion, implementing the basics of SPF, DKIM, and DMARC, and adhering to best practices is crucial. For more detailed guidance, visit: https://www.uriports.com/blog/spf-dkim-dmarc-best-practices/.
0
0
0