5 ms·

> For some companies, the DMARC and SPF records did not allow emails to be received in their mail servers from outside the company. What a mess, they cannot be

> For some companies, the DMARC and SPF records did not allow emails to be received in their mail servers from outside the company. What a mess, they cannot be reached by email at all. Huh? Those protocols are just about sending emails - not receiving mail. Was this supposed to be MX records and firewall rules?

tmikaeld 5y ago
If spf only include the company ip and the dmarc policy is to drop unknown senders, then it won’t be received by the company’s mail server, it will be dropped.
- technion 5y ago
  I can't really follow this. If I am trying to email you, there is nothing that could be broken about your DMARC policy which would prevent your mail server receiving my email. What matters would be my own policy, as the sender. Now you might prevent me seeing your replies, but that's another matter.
- kilburn 5y ago
  DMARC and SPF apply to the domain of the sender, not the recipient. If the SPF records for domain.tld only allow their network's IPs, it means that they won't accept mails FROM domain.tld that come from outside their network. Mails TO domain.tld should be accepted normally, no matter where they come from. It seems to me that the researcher was trying to communicate with those companies by sending them emails using a FROM address of the company. That is, he was sending mails with a forged FROM and SPF/DMARC stopped them as it was designed to do. Alternatively, maybe those companies were using some kind of email filtering service as "front MXes" that then tried to deliver to the company's own servers. In that case it would indeed be a mistake to not include the filtering service's forwarder's IPs in the SPF record, and they would indeed be unreachable from outside the company. In my experience this does happen from time to time, but it is very noticeable (your users will complain) and it gets fixed quickly. It's very stange to me that the researcher met this scenario multiple times...
  - bobby1 5y ago

tmikaeld 5y ago

If spf only include the company ip and the dmarc policy is to drop unknown senders, then it won’t be received by the company’s mail server, it will be dropped.

technion 5y ago
I can't really follow this. If I am trying to email you, there is nothing that could be broken about your DMARC policy which would prevent your mail server receiving my email. What matters would be my own policy, as the sender. Now you might prevent me seeing your replies, but that's another matter.
kilburn 5y ago
DMARC and SPF apply to the domain of the sender, not the recipient. If the SPF records for domain.tld only allow their network's IPs, it means that they won't accept mails FROM domain.tld that come from outside their network. Mails TO domain.tld should be accepted normally, no matter where they come from. It seems to me that the researcher was trying to communicate with those companies by sending them emails using a FROM address of the company. That is, he was sending mails with a forged FROM and SPF/DMARC stopped them as it was designed to do. Alternatively, maybe those companies were using some kind of email filtering service as "front MXes" that then tried to deliver to the company's own servers. In that case it would indeed be a mistake to not include the filtering service's forwarder's IPs in the SPF record, and they would indeed be unreachable from outside the company. In my experience this does happen from time to time, but it is very noticeable (your users will complain) and it gets fixed quickly. It's very stange to me that the researcher met this scenario multiple times...
- bobby1 5y ago