3 ms·

DMARC only requires one of SPF or DKIM to pass. DKIM passing and SPF failing won't deter DMARC; the message will land in the inbox.

joveian 2y ago
It turns out there is a bit of an exception to this, which is that plain SPF only applies to the envelope from address, not the From: field, and failure of plain SPF is sometimes (I don't know how often) considered independently from DMARC.
jsiepkes 2y ago
oh wow, didn't know that. That's actually pretty bad. Why on earth was it designed in such a way that didn't require both tests to pass if both of them are configured.
- aaronmdjones 2y ago
  Because both of them rely on DNS. DKIM is trivial to bypass if you can create a TXT record with your own key, and SPF is trivial to bypass if you can create a TXT record containing an SPF record with your own IP address / hostname / whatever. Presumably if you can compromise one of them, you can compromise both.
  - LeonM 2y ago
    > DKIM is trivial to bypass if you can create a TXT record with your own key This is exactly what DMARC prevents. With DMARC the alignment requirement is added, so signing an email with a different domain key will no longer work. For a DMARC pass you need DKIM alignment. DKIM alignment means that the email is correctly signed with a DKIM key that is published under the sender (rfc5322.From) domain.
    - aaronmdjones 2y ago
      Yes, and if you can get modification access to the TXT records for the sender's domain, you can compromise both DKIM and SPF. That's my point. Edit: More specifically, that it doesn't make sense to force both of them to pass when they both share a single point of failure.
      - LeonM 2y ago
        If your DNS is compromised it's game over anyway, because then everything is compromised. DNS is a single point of failure. You'll also be able to reroute inbound email, MITM HTTP traffic, order rogue TLS certificates, etc. etc. Saying DKIM is flawed because you can create rogue keys with DNS access is the same as saying the entire PKI is flawed because you can order certificates using DNS-01 verification.
        aaronmdjones 2y ago
        I didn't say DKIM was flawed. I wasn't complaining about DKIM at all. You may want to re-read the comment I was replying to. I'm well aware of the consequences of a DNS compromise. I simply said, twice, that DMARC forcing both SPF and DKIM to align and pass doesn't add anything of value; if you are capable of subverting one of them, you are almost certainly capable of subverting both of them at the same time.
- LeonM 2y ago
  Because SPF has many design flaws that will break SPF for legitimate use-cases (such as relaying/forwarding). You wouldn't want to rely on SPF, you should always on DKIM instead. SPF should be considered legacy at this point. But of course DMARC had to be designed with backwards compatibility in mind, thus it'll still consider the email to be DMARC alignment with just SPF alignment (without DKIM alignment). Also, understand that 'alignment' is different from a 'pass', so it's not as bad as many commenters here make it look. There are proposals of adding a flag to the DMARC policy to have the receiver ignore SPF alignment, thus enforcing DKIM alignment. However, that is not final yet.
kbolino 2y ago
That is a common DMARC configuration but not the only one. The failure tolerance is configurable.
- thenickdude 2y ago
  I don't believe this is true, the only knob to tune is for relaxed or strict alignment checks for DKIM and SPF. How do you configure DMARC to require both of DKIM and SPF? The RFC says: https://datatracker.ietf.org/doc/html/rfc7489#section-4.2 https://datatracker.ietf.org/doc/html/rfc7489#section-4.2 A message satisfies the DMARC checks if at least one of the supported authentication mechanisms: 1. produces a "pass" result, and 2. produces that result based on an identifier that is in alignment, as defined in Section 3.
  - kbolino 2y ago
    It seems you are correct. I was confusing the configurable failure reporting option (fo) as a failure tolerance option.
- deleted 2y ago
  [deleted]

joveian 2y ago

It turns out there is a bit of an exception to this, which is that plain SPF only applies to the envelope from address, not the From: field, and failure of plain SPF is sometimes (I don't know how often) considered independently from DMARC.

jsiepkes 2y ago

oh wow, didn't know that. That's actually pretty bad. Why on earth was it designed in such a way that didn't require both tests to pass if both of them are configured.

aaronmdjones 2y ago
Because both of them rely on DNS. DKIM is trivial to bypass if you can create a TXT record with your own key, and SPF is trivial to bypass if you can create a TXT record containing an SPF record with your own IP address / hostname / whatever. Presumably if you can compromise one of them, you can compromise both.
- LeonM 2y ago
  > DKIM is trivial to bypass if you can create a TXT record with your own key This is exactly what DMARC prevents. With DMARC the alignment requirement is added, so signing an email with a different domain key will no longer work. For a DMARC pass you need DKIM alignment. DKIM alignment means that the email is correctly signed with a DKIM key that is published under the sender (rfc5322.From) domain.
  - aaronmdjones 2y ago
    Yes, and if you can get modification access to the TXT records for the sender's domain, you can compromise both DKIM and SPF. That's my point. Edit: More specifically, that it doesn't make sense to force both of them to pass when they both share a single point of failure.
    - LeonM 2y ago
      If your DNS is compromised it's game over anyway, because then everything is compromised. DNS is a single point of failure. You'll also be able to reroute inbound email, MITM HTTP traffic, order rogue TLS certificates, etc. etc. Saying DKIM is flawed because you can create rogue keys with DNS access is the same as saying the entire PKI is flawed because you can order certificates using DNS-01 verification.
      - aaronmdjones 2y ago
        I didn't say DKIM was flawed. I wasn't complaining about DKIM at all. You may want to re-read the comment I was replying to. I'm well aware of the consequences of a DNS compromise. I simply said, twice, that DMARC forcing both SPF and DKIM to align and pass doesn't add anything of value; if you are capable of subverting one of them, you are almost certainly capable of subverting both of them at the same time.
LeonM 2y ago
Because SPF has many design flaws that will break SPF for legitimate use-cases (such as relaying/forwarding). You wouldn't want to rely on SPF, you should always on DKIM instead. SPF should be considered legacy at this point. But of course DMARC had to be designed with backwards compatibility in mind, thus it'll still consider the email to be DMARC alignment with just SPF alignment (without DKIM alignment). Also, understand that 'alignment' is different from a 'pass', so it's not as bad as many commenters here make it look. There are proposals of adding a flag to the DMARC policy to have the receiver ignore SPF alignment, thus enforcing DKIM alignment. However, that is not final yet.

kbolino 2y ago

That is a common DMARC configuration but not the only one. The failure tolerance is configurable.

thenickdude 2y ago
I don't believe this is true, the only knob to tune is for relaxed or strict alignment checks for DKIM and SPF. How do you configure DMARC to require both of DKIM and SPF? The RFC says: https://datatracker.ietf.org/doc/html/rfc7489#section-4.2 https://datatracker.ietf.org/doc/html/rfc7489#section-4.2 A message satisfies the DMARC checks if at least one of the supported authentication mechanisms: 1. produces a "pass" result, and 2. produces that result based on an identifier that is in alignment, as defined in Section 3.
- kbolino 2y ago
  It seems you are correct. I was confusing the configurable failure reporting option (fo) as a failure tolerance option.
deleted 2y ago
[deleted]