Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Learn and Test DMARC

learndmarc.com

Post reply on HN
Print view View original

21–30 of 65 posts

Re: Learn and Test DMARC

#21

Post by bawolff »

pests wrote: post #10
pests wrote: post #6

Very cool. > For DMARC to pass, DKIM and/or SPF checks need to pass and the domains must be in alignment. AFAIK this is incorrect. It is not "and/or" but rather "or" - only DKIM or SPF needs to pass. There is no method to require both.

This was a recent problem with Cloudflares partnership with MailChannels[1] that allowed email spoofing which was related to this. The basic problem being that mailchannel did not require authentication - cloudflare workers could just hit an API endpoint on mailchannel to send email. Mailchannel required you to add an include: record to your SPF policy. This allowed anyone to impersonate anyone else due to mailchanne…

I mean i dont think requiring dkim would stop attacks based on totally broken authentication. In that scenario, mailchimp might as well be signing the emails for the incorrect domain as well.

Re: Learn and Test DMARC

#24

Post by pests »

bawolff wrote: post #20
pests wrote: post #6

Very cool. > For DMARC to pass, DKIM and/or SPF checks need to pass and the domains must be in alignment. AFAIK this is incorrect. It is not "and/or" but rather "or" - only DKIM or SPF needs to pass. There is no method to require both.

I think you are just misparsing their grammer. I believe and/or just means inclusive or. It does not mean "and" is neccesarily an option.

I think its unambiguous. If they want "and/or" to just mean inclusive or why not just use "or". Its shorter, simpler, easier to understand. I also feel "and/or" in general usually means either option are possible/acceptable.

The point I was making is that "DMARC passes if DKIM _and_ SPF passes" and "DMARC passes if DKIM _or_ SPF passes" are both true - you can't specify "DMARC passes if, and only if, DKIM _and_ SPF passes"

Re: Learn and Test DMARC

#25

Post by pests »

bawolff wrote: post #21
pests wrote: post #10

Earlier quoted context omitted.

This was a recent problem with Cloudflares partnership with MailChannels[1] that allowed email spoofing which was related to this. The basic problem being that mailchannel did not require authentication - cloudflare workers could just hit an API endpoint on mailchannel to send email. Mailchannel required you to add an include: record to your SPF policy. This allowed anyone to impersonate anyone else due to mailchanne…

I mean i dont think requiring dkim would stop attacks based on totally broken authentication. In that scenario, mailchimp might as well be signing the emails for the incorrect domain as well.

True. MailChannels, not MailChip though. They handle email for a lot of webhosting providers.

Re: Learn and Test DMARC

#29

Post by anamexis »

jauntywundrkind wrote: post #13
guessmyname wrote: post #7

I sent an email via Apple’s “Hide My Email” service [1]. > Unhandled Promise Rejection: > TypeError: a.from.replace(/[ > dist.min.js:3:32767 This error occurred after the interface began displaying the following information: > Here are the message headers and message body: > DKIM-Signature: d=icloud.com s=1a1hai It’s been over a year since the website was featured on Hacker News (January 10, 2022), so I suspect that…

You sent an email without a "from" field and it broke. Programmer didn't think to test for bad users doing bad things. Nothing special here, no big conspiracy.

It's not a "bad user doing bad things," it's a widely-used email forwarding service.
Post reply on HN