2 ms·
DMARC is only policy, it is not SPF or DKIM. You can have any combination of DMARC, DKIM, and SPF. They are all distinct. Though with DKIM there is no way for
by georgyo 6y ago
DMARC is only policy, it is not SPF or DKIM.
You can have any combination of DMARC, DKIM, and SPF. They are all distinct.
Though with DKIM there is no way for a receiver to know if a message should be signed unless there is also a DMARC policy. SPF on the other hand can be verified without DMARC at all.
If Gmail.com had a DMARC policy that required a correct dkim signature, then the attack would have been much harder.
Also, to be clear, gmail.com DOES have a DMARC and SPF policy and does not have or use DKIM.
- uhoh-itsmaciek 6y ago>If Gmail.com had a DMARC policy that required a correct dkim signature, then the attack would have been much harder. Can you have a policy like that? I was under the impression that DMARC passes if either SPF or DKIM passes.
- LeonM 6y ago> Can you have a policy like that? No you cannot, like you said: DMARC passes if either SPF or DKIM passes. But what you can do is use the 'aspf' and 'adkim' settings to force strict alignment on SPF and/or DKIM for DMARC to pass. We see some of our [0] customers using strict SPF alignment to basically force DMARC SPF alignment to fail most of the time, thus effectively forcing a DKIM requirement for DMARC to pass. We wouldn't recommend doing this though, unless you are already closely monitoring your email traffic, and getting close to 100% DMARC alignment. Note that none of this would have helped against the vulnerability discovered in the OP though. [0] https://www.mailhardener.com https://www.mailhardener.com
- garaetjjte 6y ago>Though with DKIM there is no way for a receiver to know if a message should be signed unless there is also a DMARC policy. As a trivia, there was also ADSP but it didn't really gained adoption: https://tools.ietf.org/html/rfc5617 https://tools.ietf.org/html/rfc5617