Resources / DMARC and mail
Who sends mail as you, and what DMARC does not stop
DMARC answers one question: did this message, with your domain in the From address, come from somewhere your domain allows? At reject, it stops every message where the answer is no. That closes the easiest attack, forging your exact domain. It leaves the attacks that do not use your exact domain, and the ones that do use it from somewhere you allowed.
What DMARC stops, and what it does not
Your exact domain, forged
From: billing@yourdomain.com, sent from a server you have never used.
Stops it at quarantine or reject. Shows it in reports at none.
A subdomain that does not exist
From: alerts@secure.yourdomain.com
Stops it when the subdomain policy (sp=) is quarantine or reject. With no sp=, the main policy applies.
A sender you allow, used by somebody else
Mail that passes, sent through a shared service in your SPF record.
Passes. If a shared service lets any customer set your domain as the return path, another customer passes SPF as you.
DKIM replay
One real message of yours, signed by you, sent again to thousands of people.
Passes. The signature is real. Reports show your domain passing from servers you do not run.
A lookalike domain
From: billing@yourdomaln.com, with an l in place of the i.
Never sees it. It is another domain, with its own DMARC record, and it can pass.
A display name
From: "Your CEO" <ceo.office.mail@gmail.com>
Never sees it. The domain is gmail.com, and Gmail passes.
A real account, taken over
Mail from your supplier's real mailbox, asking for a change of bank details.
Passes. Everything about it is real except the person typing.
What the reports show about abuse
Aggregate reports list every server that sent mail with your domain in the From address, and they list the ones you did not set up too. Three patterns are worth a look:
- Failing mail from servers you cannot name, often in many countries at once. That is forgery, and the policy is doing its job. At none, it is reaching inboxes.
- Passing mail from a server you do not run, signed with your key. A real message of yours is being sent again: DKIM replay. Find which message, and which service signed it.
- Passing mail on SPF alone from a shared service that none of your applications uses. Somebody is using that service in your name. Take the include out of your SPF record, or ask the service.
Limits on DKIM replay
A replay works because a DKIM signature proves a message is unchanged, not that it is going to the person it was written for. Services that sign for you can make a replay harder: sign the To and Subject headers so they cannot be changed, sign headers a second time so none can be added, and give signatures a short life with the x= tag. Keep the messages that are worth replaying, such as order confirmations with free text in them, on a service that does this.
The attacks DMARC never sees
A lookalike domain is somebody else's domain. It has its own DMARC record and can pass every check, so no report of yours will mention it. The only way to know about one is to watch for it: make every name that a person could mistake for yours, and check which of them are registered and can send mail. That is what the open record does for the 100 most popular domains, and the lookalike checker does for yours.
Check where you stand
The DMARC checker says whether your domain is at reject, whether your subdomains are, and which shared services your SPF record allows to send as you.