3 ms·
>If Gmail.com had a DMARC policy that required a correct dkim signature, then the attack would have been much harder. Can you have a policy like that? I was un
by uhoh-itsmaciek 6y ago
>If Gmail.com had a DMARC policy that required a correct dkim signature, then the attack would have been much harder.
Can you have a policy like that? I was under the impression that DMARC passes if either SPF or DKIM passes.
- LeonM 6y ago> Can you have a policy like that? No you cannot, like you said: DMARC passes if either SPF or DKIM passes. But what you can do is use the 'aspf' and 'adkim' settings to force strict alignment on SPF and/or DKIM for DMARC to pass. We see some of our [0] customers using strict SPF alignment to basically force DMARC SPF alignment to fail most of the time, thus effectively forcing a DKIM requirement for DMARC to pass. We wouldn't recommend doing this though, unless you are already closely monitoring your email traffic, and getting close to 100% DMARC alignment. Note that none of this would have helped against the vulnerability discovered in the OP though. [0] https://www.mailhardener.com https://www.mailhardener.com