4 ms·

We've had a spate of fake emails between our CFO and CEO in our company. Seeing as we use google apps for our email, it would be really nice if google could wa

by herge 10y ago

We've had a spate of fake emails between our CFO and CEO in our company. Seeing as we use google apps for our email, it would be really nice if google could warn in their interface that this email may have the CFO's address, but it did not come from internal mail...

tyingq 10y ago
I believe if you publish a DMARC policy for your domain, to reject unauthenticated email from your domain, then the forged emails wouldn't ever land in the inbox. https://support.google.com/mail/answer/2451690 https://support.google.com/mail/answer/2451690 https://support.google.com/a/answer/2466580 https://support.google.com/a/answer/2466580
- BatFastard 10y ago
  Gmail seems to have a robust policy for dealing with exactly these errors. Thanks for pointing it out.
- upofadown 10y ago
  DMARC is a message to other entities about what you want them to do in case DKIM/SPF fails. In this case that wouldn't help as the problem is with your entity. So you would just have to reject things that fail your DKIM (or more practically, add a warning to the subject line).
  - tyingq 10y ago
    In this case, the parent is using Google Apps, and is receiving forged outside emails "from" their own domain, to recipients within that domain. The way to tell Google apps "don't accept outside forged emails from my domain" is a DMARC policy, combined with the pre-reqs for that. Google apps happily puts forged emails (from your own domain) into your inbox if you don't. >>DMARC is a message to other entities about what you want them to do in case DKIM/SPF fails Yes, but it also drives what your hosted Gapps/Gmail instance does with incoming forged email for your own domain. Google could provide a toggle or functionality to say what to do with failed DKIM and/or SPF more generally, for all domains...but they don't. I can tell you for sure that messages with failures for both regularly land in the inbox within my Google Apps Gmail.
cmdrfred 10y ago
Postfix has the feature you require[0]. Does google support anything along these lines? https://serverfault.com/questions/321109/how-to-prevent-remote-hosts-from-delivering-mail-to-postfix-with-spoofed-from-he https://serverfault.com/questions/321109/how-to-prevent-remo...

by herge 10y ago

tyingq 10y ago

I believe if you publish a DMARC policy for your domain, to reject unauthenticated email from your domain, then the forged emails wouldn't ever land in the inbox. https://support.google.com/mail/answer/2451690 https://support.google.com/mail/answer/2451690 https://support.google.com/a/answer/2466580 https://support.google.com/a/answer/2466580

BatFastard 10y ago
Gmail seems to have a robust policy for dealing with exactly these errors. Thanks for pointing it out.
upofadown 10y ago
DMARC is a message to other entities about what you want them to do in case DKIM/SPF fails. In this case that wouldn't help as the problem is with your entity. So you would just have to reject things that fail your DKIM (or more practically, add a warning to the subject line).
- tyingq 10y ago
  In this case, the parent is using Google Apps, and is receiving forged outside emails "from" their own domain, to recipients within that domain. The way to tell Google apps "don't accept outside forged emails from my domain" is a DMARC policy, combined with the pre-reqs for that. Google apps happily puts forged emails (from your own domain) into your inbox if you don't. >>DMARC is a message to other entities about what you want them to do in case DKIM/SPF fails Yes, but it also drives what your hosted Gapps/Gmail instance does with incoming forged email for your own domain. Google could provide a toggle or functionality to say what to do with failed DKIM and/or SPF more generally, for all domains...but they don't. I can tell you for sure that messages with failures for both regularly land in the inbox within my Google Apps Gmail.

cmdrfred 10y ago

Postfix has the feature you require[0]. Does google support anything along these lines? https://serverfault.com/questions/321109/how-to-prevent-remote-hosts-from-delivering-mail-to-postfix-with-spoofed-from-he https://serverfault.com/questions/321109/how-to-prevent-remo...