4 ms·
This is a great find. I bet there are similar bugs hiding in many hosted mail platforms. I always wanted to test MS365, but never got around to it. IIRC if y
by ryan29 6y ago
This is a great find. I bet there are similar bugs hiding in many hosted mail platforms.
I always wanted to test MS365, but never got around to it. IIRC if you don't configure DKIM, they'll still sign messages using your x.onmicrosoft.com perma-ID. I remember being surprised those signatures show as valid when received in GSuite since the DKIM signing domain is different than the sending domain. Does that have something to do with ARC sealing? It should be impossible, right?
I could be totally out to lunch though since I noticed that when trying to diagnose broken DKIM signatures on a domain.
I'm also skeptical with half the planet having SPF records that point to Microsoft or Google. The dependence on domain validation after that is what makes me think there could be a lot of bugs of this class hanging around.
I bet shared hosting is a massive disaster in this area too.
- roketridah 6y agoIf memory serves me right DKIM only mandates that the DKIM signature header is valid for the d= domain used by verifiying that the protected fields where not changed - but it makes no claims on alignment of the d= domain in the DKIM signature and the protected headers. So anyone can sign for any domain for which they have published DKIM keys, and produce valid DKIM. It's DMARC that requires that a valid DKIM signature match the d= domain with the From domain to consider the message DMARC aligned and be awarded a DMARC pass. [or otherwise pass SPF checks and have SPF domain aligned with From domain] Edit: typo, clarity
- ryan29 6y agoAh. That makes a lot more sense. Thanks!