Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Learn and Test DMARC

learndmarc.com

Post reply on HN
Print view View original

1–10 of 65 posts

Re: Learn and Test DMARC

#6

Post by pests »

Very cool.

> For DMARC to pass, DKIM and/or SPF checks need to pass and the domains must be in alignment.

AFAIK this is incorrect.

It is not "and/or" but rather "or" - only DKIM or SPF needs to pass. There is no method to require both.

Re: Learn and Test DMARC

#7

Post by guessmyname »

I sent an email via Apple’s “Hide My Email” service [1].

> Unhandled Promise Rejection:

> TypeError: a.from.replace(/[

> dist.min.js:3:32767

This error occurred after the interface began displaying the following information:

> Here are the message headers and message body:

> DKIM-Signature: d=icloud.com s=1a1hai

It’s been over a year since the website was featured on Hacker News (January 10, 2022), so I suspect that the JavaScript code may have become outdated and non-functional. It’s possible that it never supported Safari browsers in the first place, or perhaps it’s a combination of both issues. Nevertheless, I’ve learned a lot from the initial [2] and second [3] parts of the DMARC test, which gives me some insight into what might be happening in the subsequent steps.

[1] https://support.apple.com/en-us/HT210425

[2] dig +noall +answer -t TXT | grep -i SPF

[3] dig +noall +answer -t A

Re: Learn and Test DMARC

#10

Post by pests »

pests wrote: post #6

Very cool. > For DMARC to pass, DKIM and/or SPF checks need to pass and the domains must be in alignment. AFAIK this is incorrect. It is not "and/or" but rather "or" - only DKIM or SPF needs to pass. There is no method to require both.

This was a recent problem with Cloudflares partnership with MailChannels[1] that allowed email spoofing which was related to this.

The basic problem being that mailchannel did not require authentication - cloudflare workers could just hit an API endpoint on mailchannel to send email. Mailchannel required you to add an include: record to your SPF policy. This allowed anyone to impersonate anyone else due to mailchannel being a valid sender for all domains.

Only ~400 domains of the 2M hosted had DKIM set up but even if they did the passing SPF caused DMARC to pass.

[1] https://blog.cloudflare.com/sending-email-from-workers-with-...

Post reply on HN