Remix.run Logo
AshamedCaptain 6 hours ago

And SPF doesn't?

aaronmdjones an hour ago | parent | next [-]

No, it doesn't.

In the following SMTP conversation:

  MAIL FROM: foo@example.net
  RCPT TO: victim@example.com
  DATA
  From: service@paypal.co.uk
  To: victim@example.com
  Subject: We are updating our Terms of Service
  [...]
SPF checks whether the sending host is allowed to send e-mail from example.net (the envelope sender).

The recipient sees service@paypal.co.uk (the From address on the inner message), because most ESPs do them the great disservice of not indicating that the sender identities are not aligned.

Adding a DMARC record to a domain requires that e-mail whose inner messages claim to be from that domain must have sender alignment to the envelope sender.

The above message would pass SPF (if the spammer owns example.net and has created SPF records for themselves) but would fail DMARC (paypal.co.uk's DMARC record exists, so alignment is required, and yet example.net != paypal.co.uk, so they are not aligned). In this case their DMARC policy says to reject the message, so (if the recipient is checking DMARC) it would either be rejected outright or it would land in Spam/Quarantine rather than Inbox.

ivlad 5 hours ago | parent | prev | next [-]

Technically, no.

SPF allows to say “these IPs are authorised to send emails as example.com”, where DMARC allows to say “I as domain owner recommend to quarantine emails that fail SPF and DKIM”, it also allows finer alignment (ie, matching between different “from” parameters) configuration and reporting by the receivers.

Of course, with absence of DNARC policies, receivers default to some internal defaults, or may ignore the policies altogether. But at least, the big ones send DMARC reports.

wolttam 5 hours ago | parent | prev [-]

Not always. An email has a valid SPF when its return path email’s domain permits the sending server’s IP. But that email may have a forged From: header (which causes an SPF mis-alignment), and the receiving server checks the DMARC of *the From header* domain to determine how to handle that mis-alignment.