Mail Security

Periodically we get "security researchers" telling us that our mail setup is prone to spoofing.

They suggest that we deploy some of the more modern technologies to minimise this issue, specifically SPF, DKIM and DMARC.

As far as I can work out, none of these can actually help with the way we work. I've attempted to dump my understanding of what the different technologies do here, and would encourage anyone who believes that I am wrong to contact me at robin.watts@artifex.com with suggested updates.

SPF

The Sender Policy Framework header allows a domain owner (i.e. us) to give a simple set of rules that define whether a given email was sent from a genuine sender (things like "it was sent from a particular server"), and what to do if it doesn't match the rules ("bad", "neutral", "good").

We don't have a central mailserver, instead, everyone sends their emails using their ISPs own mailservers.

We could try and list all the mailservers we use normally to the DNS entry, but that's potentially a huge and ever changing list.

Or we could move over to using a central mailserver, which everyone would need to change over to using. Possibly we have access to such a central mailserver as part of our deal to have google handle our domain.

In the absence of everyone using such a central mailserver, the best we can do is to give a "neutral" response for all messages. That's what we do.

DKIM

The Domain Keys Identified Mail system is a cryptographically based system whereby messages are signed. As I understand it, it basically provides a way for systems to know that nothing has altered an email since it was sent from the original mailserver.

My limited understanding of this suggests that it's something that is done at the mailserver level. As such either we'd need to share a cryptographic key around EVERY one of the mailservers that we use, or again, we'd need to move to a single mailserver.

DMARC

The Domain-based Message Authentication, Reporting & Conformance system, as far as I can see, allows for rules that say "Use SPF and/or DKIM. Filter n% of messages. If they fail, quarantine/bin/send them anyway. Send failure reports to whoever@whereever.com."

i.e. it's a way for domain owners to actually get feedback about which emails are being rejected, rather than a new way to validate them.

Upshot

The upshot of all this to me is that:

• SPF is useless to us unless we can either a) move everyone to using a central email server, or b) list all the mailservers we use in the record.
• DKIM is useless to us unless we move everyone to using a central email server. If we do move everyone to using a central email server, it's not clear to me what we actually gain for it.
• DMARC is useless unless we want to monitor how either of the other two are working out.

Robin Watts - 2020-09-04

Comments

<--/commentPlugin-->