3 ms·
Agreed, seems like people are just too scared to reject potentially broken email. If your mail server receives an email that claims to be from paypal.com, but
by sliken 8y ago
Agreed, seems like people are just too scared to reject potentially broken email.
If your mail server receives an email that claims to be from paypal.com, but it's not dkim signed (by paypal.com) it should be rejected.
But even paypal.com, likely one of the top phisher targets publishes their DKIM signature with:
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mail.paypal.com;
I'm surprised that even internal email systems inside of companies regularly accept email from allegedly inside the company, that are forgeries. You'd think ibm.com (just an example) would A) sign ALL outgoing email B) check DKIM for all incoming email C) reject anything claiming ibm.com, but without the ibm.com signature.
Seems insane that it's so easy to send email as a companies/organizations management.
- toast0 8y agoRelaxed in DKIM allows for non signficant changes in headers (ex case of the header names, extraneous whitespace, line folding) and for changes in trailing whitespace in the body. Headers and body are configured separately, but relaxed/relaxed ends up being fairly necessary. What you want to look at is their DMARC record: v=DMARC1; p=reject; rua=mailto:d@rua.agari.com; ruf=mailto:d@ruf.agari.com Which says they'd like servers to reject mail unless it passes SPF or DKIM. (There's no way to say it should pass both, although I guess if your SPF record was -all, you would need to pass DKIM)
- sliken 8y agoAh, that should teach me to post before checking the spec. Thanks.