Abstract image of a woman sitting on books and studying on a laptop

Fighting Abuse with DNS

Men and Mice, profile picture
Men and Mice

The document discusses email authentication methods including SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting & Conformance). It describes how each method operates, their purposes in validating email messages, and the difficulties encountered, especially with mail forwarding. Additionally, it provides examples of DNS records for setting up SPF and DKIM, as well as their implications for email security.

Technology
1 of 45
Downloaded 119 times
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
© Men & Mice http://menandmice,com SPF, DKIM and DMARC Mail-Reputation and DNS Wednesday 26 October 16
© Men & Mice http://menandmice,com Sender Policy Framework Wednesday 26 October 16
© Men & Mice http://menandmice,com SPF •Sender Policy Framework (SPF) defines the addresses mails can be originated for a given domain •this information is stored in it’s own SPF-Format inside a TXT-Record • there has been a dedicated SPF record type, that has been deprecated because it was ignored by Mail- and DNS-admins •Website: http://www.openspf.org Wednesday 26 October 16
© Men & Mice http://menandmice,com SPF-Example •the Google SPF-Record google.com. 3600 IN TXT "v=spf1 include:_spf.google.com ~all" Mail-Sender Domain SPF-Format Version Include SPF- Information from subdomain Soft-Fail SPF- Checks Wednesday 26 October 16
© Men & Mice http://menandmice,com SPF-Example •the Google SPF-Record _spf.google.com. 299 INTXT "v=spf1 include:_netblocks.google.com include:_netblocks2.google.com include:_netblocks3.google.com ~all" Includes of Google Network Blocks Wednesday 26 October 16
© Men & Mice http://menandmice,com SPF-Example •the Google SPF-Record _spf.google.com. 299 INTXT "v=spf1 include:_netblocks.google.com include:_netblocks2.google.com include:_netblocks3.google.com ~all" Includes of Google Network Blocks Wednesday 26 October 16
© Men & Mice http://menandmice,com SPF-Example •the Google SPF-Record _netblocks.google.com. 3600 IN TXT "v=spf1 ip4:64.18.0.0/20 ip4:64.233.160.0/19 ip4:66.102.0.0/20 ip4:66.249.80.0/20 ip4:72.14.192.0/18 ip4:74.125.0.0/16 ip4:108.177.8.0/21 ip4:173.194.0.0/16 ip4:207.126.144.0/20 ip4:209.85.128.0/17 ip4:216.58.192.0/19 ip4:216.239.32.0/19 ~all" Google Mail-Sending addresses Wednesday 26 October 16
© Men & Mice http://menandmice,com SPF-Operation example.com authoritative DNS example.com outgoing mail receiving mail server sending mail on port 25 from 192.0.2.123 Wednesday 26 October 16
© Men & Mice http://menandmice,com SPF-Operation example.com authoritative DNS example.com outgoing mail receiving mail server sending mail on port 25 from 192.0.2.123 looking up SPF-Record for “example.com” Wednesday 26 October 16
© Men & Mice http://menandmice,com SPF-Operation example.com authoritative DNS example.com outgoing mail receiving mail server sending mail on port 25 from 192.0.2.123 example.com IN TXT “v=spf1 ipv4:192.0.2.0/24 -all” Wednesday 26 October 16
© Men & Mice http://menandmice,com SPF-Operation example.com authoritative DNS example.com outgoing mail receiving mail server sending mail on port 25 from 192.0.2.123 check if sending address is within SPF- Data Wednesday 26 October 16
© Men & Mice http://menandmice,com SPF-Operation example.com authoritative DNS example.com outgoing mail receiving mail server mail has been received Wednesday 26 October 16
© Men & Mice http://menandmice,com SPF issues •SPF is problematic with some mail functions where mail is send indirectly •mail-forwarding •mailing lists •webforms - http://bsdly.blogspot.nl/2016/10/is-spf-simply-too-hard-for-application.html Wednesday 26 October 16
© Men & Mice http://menandmice,com SPF problem with forwarding example.com authoritative DNS example.com outgoing mail receiving mail server mailing-list server sending mail from user@example.com on port 25 from 192.0.2.123 Wednesday 26 October 16
© Men & Mice http://menandmice,com SPF problem with forwarding example.com authoritative DNS example.com outgoing mail receiving mail server mailing-list server sending mail from user@example.com on port 25 from 203.0.113.23 Wednesday 26 October 16
© Men & Mice http://menandmice,com SPF problem with forwarding example.com authoritative DNS example.com outgoing mail receiving mail server mailing-list server sending mail from user@example.com on port 25 from 203.0.113.23 looking up SPF-Record for “example.com” Wednesday 26 October 16
© Men & Mice http://menandmice,com SPF problem with forwarding example.com authoritative DNS example.com outgoing mail receiving mail server mailing-list server sending mail from user@example.com on port 25 from 203.0.113.23 example.com IN TXT “v=spf1 ipv4:192.0.2.0/24 -all” Wednesday 26 October 16
© Men & Mice http://menandmice,com SPF problem with forwarding example.com authoritative DNS example.com outgoing mail receiving mail server mailing-list server sending mail from user@example.com on port 25 from 203.0.113.23 check if sending address is within SPF- Data Wednesday 26 October 16
© Men & Mice http://menandmice,com SPF problem with forwarding example.com authoritative DNS example.com outgoing mail receiving mail server mailing-list server sending mail from user@example.com on port 25 from 203.0.113.23 mail rejected, as the sender IP does not appear in the SPF data Wednesday 26 October 16
© Men & Mice http://menandmice,com SPF problem with forwarding example.com authoritative DNS example.com outgoing mail receiving mail server mailing-list server sending mail from user@example.com on port 25 from 203.0.113.23 mail rejected, as the sender IP does not appear in the SPF data Wednesday 26 October 16
© Men & Mice http://menandmice,com DKIM DomainKeys Identified Mail Wednesday 26 October 16
© Men & Mice http://menandmice,com DKIM • DKIM cryptographically signs selected mail headers and the mail content • DKIM is used to validate the mail message content but not to secure the transport path • No upgrade to User Client (Client E-Mail program) needed • But E-Mail Clients can offer per-User signing, as an option • DKIM Management can be “outsourced” (ISP, E-Mail Hosting Provider) • No PKI Infrastructure needed, only depends on DNS Wednesday 26 October 16
© Men & Mice http://menandmice,com DKIM • DKIM Website • http://dkim.org/ • Documents • RFC 5585 - DomainKeys Identified Mail (DKIM) Service Overview https://tools.ietf.org/html/rfc5585 • RFC 6376 - DomainKeys Identified Mail (DKIM) Signatures https://tools.ietf.org/html/rfc6376 • RFC 5863 - DomainKeys Identified Mail (DKIM) Development, Deployment, and Operations https://tools.ietf.org/html/rfc5863 • RFC 5617 - DomainKeys Identified Mail (DKIM) Author Domain Signing Practices (ADSP) https://tools.ietf.org/html/rfc5617 • RFC 6377 - DomainKeys Identified Mail (DKIM) and Mailing Lists https://tools.ietf.org/html/rfc6377 Wednesday 26 October 16
© Men & Mice http://menandmice,com DKIM Signature in the Mail Header DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mennogmys.onmicrosoft.com; s=selector1-menandmice-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=Rk04UQbu8aZGogweVSHLqo55rIPXR0OajjGVpZOcEic=; b=cVQyry/E2yMiV9qUZbth0Y51r5OoWoHPr0qYklZYGvc6/[...] DKIM Version Wednesday 26 October 16
© Men & Mice http://menandmice,com DKIM Signature in the Mail Header DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mennogmys.onmicrosoft.com; s=selector1-menandmice-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=Rk04UQbu8aZGogweVSHLqo55rIPXR0OajjGVpZOcEic=; b=cVQyry/E2yMiV9qUZbth0Y51r5OoWoHPr0qYklZYGvc6/[...] DKIM Signing Algorithm Wednesday 26 October 16
© Men & Mice http://menandmice,com DKIM Signature in the Mail Header DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mennogmys.onmicrosoft.com; s=selector1-menandmice-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=Rk04UQbu8aZGogweVSHLqo55rIPXR0OajjGVpZOcEic=; b=cVQyry/E2yMiV9qUZbth0Y51r5OoWoHPr0qYklZYGvc6/[...] canonicalization algorithm: "relaxed" algorithm that tolerates common modifications such as whitespace replacement and header field line rewrapping Wednesday 26 October 16
© Men & Mice http://menandmice,com DKIM Signature in the Mail Header DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mennogmys.onmicrosoft.com; s=selector1-menandmice-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=Rk04UQbu8aZGogweVSHLqo55rIPXR0OajjGVpZOcEic=; b=cVQyry/E2yMiV9qUZbth0Y51r5OoWoHPr0qYklZYGvc6/[...] Domain of the sending party, this is where the public key to verify the signature is located Wednesday 26 October 16
© Men & Mice http://menandmice,com DKIM Signature in the Mail Header DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mennogmys.onmicrosoft.com; s=selector1-menandmice-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=Rk04UQbu8aZGogweVSHLqo55rIPXR0OajjGVpZOcEic=; b=cVQyry/E2yMiV9qUZbth0Y51r5OoWoHPr0qYklZYGvc6/[...] Subdomain selector: will pre prepended to the domain to fetch the DKIM public key Wednesday 26 October 16
© Men & Mice http://menandmice,com Fetching the DKIM key •The DKIM public key can be found inside a TXT record at a domain name build from • selector • subdomain “_domainkey” • base mail domain (d: field) $ dig selector1-menandmice-com._domainkey.mennogmys.onmicrosoft.com TXT +short "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDenG16IONFpDPACAhDnCd/ N98W277rSbwSoatar767pSYtT+CClFqhmEePynSVGdS0RxIjFZscmVN5RZjnfD +HE1HL4XvUtxnnb1j0PeNfhrDHy7BHFGux6exfL7/splByKu7qhLBP10+SyAjiE4Qc6xWfCQ3MzmECZGW/ CzzmOQIDAQAB; n=1024,1450909615,1" Wednesday 26 October 16
© Men & Mice http://menandmice,com DKIM Signature in the Mail Header DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mennogmys.onmicrosoft.com; s=selector1-menandmice-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=Rk04UQbu8aZGogweVSHLqo55rIPXR0OajjGVpZOcEic=; b=cVQyry/E2yMiV9qUZbth0Y51r5OoWoHPr0qYklZYGvc6/[...] Header-Fields signed by the sending party Wednesday 26 October 16
© Men & Mice http://menandmice,com DKIM Signature in the Mail Header DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mennogmys.onmicrosoft.com; s=selector1-menandmice-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=Rk04UQbu8aZGogweVSHLqo55rIPXR0OajjGVpZOcEic=; b=cVQyry/E2yMiV9qUZbth0Y51r5OoWoHPr0qYklZYGvc6/[...] Body-Hash: Hash of the message body Wednesday 26 October 16
© Men & Mice http://menandmice,com DKIM Signature in the Mail Header DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mennogmys.onmicrosoft.com; s=selector1-menandmice-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=Rk04UQbu8aZGogweVSHLqo55rIPXR0OajjGVpZOcEic=; b=cVQyry/E2yMiV9qUZbth0Y51r5OoWoHPr0qYklZYGvc6/[...] Signature over header fields and Body-Hash Wednesday 26 October 16
© Men & Mice http://menandmice,com DKIM operation example.com authoritative DNS example.com outgoing mail receiving mail server mail forwarder mail get signed with “example.com” private DKIM key Wednesday 26 October 16
© Men & Mice http://menandmice,com DKIM operation example.com authoritative DNS example.com outgoing mail receiving mail server mail forwarder sending mail from user@example.com on port 25 from 192.0.2.123 Wednesday 26 October 16
© Men & Mice http://menandmice,com SPF problem with forwarding example.com authoritative DNS example.com outgoing mail receiving mail server sending mail from user@example.com on port 25 from 203.0.113.23 mail forwarder Wednesday 26 October 16
© Men & Mice http://menandmice,com SPF problem with forwarding example.com authoritative DNS example.com outgoing mail receiving mail server sending mail from user@example.com on port 25 from 203.0.113.23 looking up DKIM public key for “example.com” mail forwarder Wednesday 26 October 16
© Men & Mice http://menandmice,com SPF problem with forwarding example.com authoritative DNS example.com outgoing mail receiving mail server sending mail from user@example.com on port 25 from 203.0.113.23 _domainkeys.example.com IN TXT “v=DKIM1; k=rsa; p=MIG[...]” mail forwarder Wednesday 26 October 16
© Men & Mice http://menandmice,com SPF problem with forwarding example.com authoritative DNS example.com outgoing mail receiving mail server sending mail from user@example.com on port 25 from 203.0.113.23 validating DKIM signed headers and body mail forwarder Wednesday 26 October 16
© Men & Mice http://menandmice,com SPF problem with forwarding example.com authoritative DNS example.com outgoing mail receiving mail server mailing-list server mail has been received Wednesday 26 October 16
© Men & Mice http://menandmice,com DMARC Domain-based Message Authentication, Reporting & Conformance Wednesday 26 October 16
© Men & Mice http://menandmice,com DMARC •DMARC builds on top of SPF and DKIM •it allows the owner of an email domain to publish a policy about SPF and DKIM failures •DMARC can be used to publish a feedback channel to let the domain owner know of spoofed mail from his domain •the DMARC policy is stored in DNS Wednesday 26 October 16
© Men & Mice http://menandmice,com DMARC •example DMARC record "v=DMARC1;p=reject;pct=100;rua=mailto:postmaster@example.com" Protocol Version Wednesday 26 October 16
© Men & Mice http://menandmice,com DMARC •example DMARC record "v=DMARC1;p=reject;pct=100;rua=mailto:postmaster@example.com" Policy for organizational domain Wednesday 26 October 16
© Men & Mice http://menandmice,com DMARC •example DMARC record "v=DMARC1;p=reject;pct=100;rua=mailto:postmaster@example.com" Percentage of messages subjected to filtering Wednesday 26 October 16
© Men & Mice http://menandmice,com DMARC •example DMARC record "v=DMARC1;p=reject;pct=100;rua=mailto:postmaster@example.com" Where to send the aggregated mis-use reports Wednesday 26 October 16

More Related Content

PDF
More mastering the art of indexing
Yoshinori Matsunobu
 
PDF
Partitions Performance with MySQL 5.1 and 5.5
Giuseppe Maxia
 
PPTX
Understanding and tuning WiredTiger, the new high performance database engine...
Ontico
 
DOCX
Linux crontab
Teja Bheemanapally
 
PDF
sqlmap - Under the Hood
Miroslav Stampar
 
PDF
Galera Cluster - Node Recovery - Webinar slides
Severalnines
 
PDF
What’s wrong with WebSocket APIs? Unveiling vulnerabilities in WebSocket APIs.
Mikhail Egorov
 
PDF
DNS exfiltration using sqlmap
Miroslav Stampar
 
More mastering the art of indexing
Yoshinori Matsunobu
 
Partitions Performance with MySQL 5.1 and 5.5
Giuseppe Maxia
 
Understanding and tuning WiredTiger, the new high performance database engine...
Ontico
 
Linux crontab
Teja Bheemanapally
 
sqlmap - Under the Hood
Miroslav Stampar
 
Galera Cluster - Node Recovery - Webinar slides
Severalnines
 
What’s wrong with WebSocket APIs? Unveiling vulnerabilities in WebSocket APIs.
Mikhail Egorov
 
DNS exfiltration using sqlmap
Miroslav Stampar
 

What's hot (20)

PDF
Oracle Real Application Clusters 19c- Best Practices and Internals- EMEA Tour...
Sandesh Rao
 
PPT
IBM Lotus Domino Domain Monitoring (DDM)
Austin Chang
 
PPTX
Enable Domino Data Access Services (DAS)
Slobodan Lohja
 
PPT
Backup And Recovery
raghu_designer
 
PPTX
Catch Me If You Can: PowerShell Red vs Blue
Will Schroeder
 
PDF
MySQL Administrator 2021 - 네오클로바
NeoClova
 
PDF
가상머신 환경에서 리눅스 및 큐브리드 설치 가이드 20150714
경오 이
 
PPTX
SolarWinds Scalability for the Enterprise
SolarWinds
 
PDF
Pwning in c++ (basic)
Angel Boy
 
PDF
Building ClickHouse and Making Your First Contribution: A Tutorial_06.10.2021
Altinity Ltd
 
PDF
State transfer With Galera
Mydbops
 
PDF
Security Monitoring with eBPF
Alex Maestretti
 
PDF
Non-regression testing in web app development
Cédric Villa
 
PDF
Course 102: Lecture 4: Using Wild Cards
Ahmed El-Arabawy
 
PPTX
Yaml
Christoph Santschi
 
PDF
Zabbix: Uma ferramenta para Gerenciamento de ambientes de T.I
Aécio Pires
 
PDF
How Prometheus Store the Data
Hao Chen
 
PDF
HTTP - The Other Face Of Domino
Gabriella Davis
 
PDF
IBM Notes Traveler Best Practices
jayeshpar2006
 
PDF
Monitoramento de serviços com Zabbix + Grafana + Python - Marcelo Santoto - D...
Felipe Blini
 
Oracle Real Application Clusters 19c- Best Practices and Internals- EMEA Tour...
Sandesh Rao
 
IBM Lotus Domino Domain Monitoring (DDM)
Austin Chang
 
Enable Domino Data Access Services (DAS)
Slobodan Lohja
 
Backup And Recovery
raghu_designer
 
Catch Me If You Can: PowerShell Red vs Blue
Will Schroeder
 
MySQL Administrator 2021 - 네오클로바
NeoClova
 
가상머신 환경에서 리눅스 및 큐브리드 설치 가이드 20150714
경오 이
 
SolarWinds Scalability for the Enterprise
SolarWinds
 
Pwning in c++ (basic)
Angel Boy
 
Building ClickHouse and Making Your First Contribution: A Tutorial_06.10.2021
Altinity Ltd
 
State transfer With Galera
Mydbops
 
Security Monitoring with eBPF
Alex Maestretti
 
Non-regression testing in web app development
Cédric Villa
 
Course 102: Lecture 4: Using Wild Cards
Ahmed El-Arabawy
 
Yaml
Christoph Santschi
 
Zabbix: Uma ferramenta para Gerenciamento de ambientes de T.I
Aécio Pires
 
How Prometheus Store the Data
Hao Chen
 
HTTP - The Other Face Of Domino
Gabriella Davis
 
IBM Notes Traveler Best Practices
jayeshpar2006
 
Monitoramento de serviços com Zabbix + Grafana + Python - Marcelo Santoto - D...
Felipe Blini
 
Ad

Viewers also liked (20)

PDF
What is new in BIND 9.11?
Men and Mice
 
PDF
TLS, SPF, DKIM, DMARC, authenticated email
rinnocente
 
PDF
DNS High-Availability Tools - Open-Source Load Balancing Solutions
Men and Mice
 
PDF
BIND 9 logging best practices
Men and Mice
 
PPTX
Using DMARC to Improve Your Email Reputation
Terry Zink
 
PDF
DNSSEC best practices Webinar
Men and Mice
 
PDF
SPF, DKIM en DMARC
Jeffrey Cafferata
 
PDF
Keeping DNS server up-and-running with “runit
Men and Mice
 
PDF
Yeti DNS - Experimenting at the root
Men and Mice
 
PDF
Community tools to fight against DDoS, SANOG 27
APNIC
 
PDF
Community tools to fight against DDoS
Fakrul Alam
 
PDF
Windows 2012 and DNSSEC
Men and Mice
 
PPT
Dns protocol design attacks and security
Michael Earls
 
PPS
Linux15 dynamic dns-2
Jainul Musani
 
PPS
Linux14 Dynamic DNS
Jainul Musani
 
PDF
DNSSEC and DANE – E-Mail security reloaded
Men and Mice
 
PDF
DNSTap Webinar
Men and Mice
 
PDF
DDoS Attacks : Preparation Detection Mitigation
Fakrul Alam
 
PPTX
Fighting Email Abuse with DMARC
Kurt Andersen
 
PDF
CNIT 40: 2: DNS Protocol and Architecture
Sam Bowne
 
What is new in BIND 9.11?
Men and Mice
 
TLS, SPF, DKIM, DMARC, authenticated email
rinnocente
 
DNS High-Availability Tools - Open-Source Load Balancing Solutions
Men and Mice
 
BIND 9 logging best practices
Men and Mice
 
Using DMARC to Improve Your Email Reputation
Terry Zink
 
DNSSEC best practices Webinar
Men and Mice
 
SPF, DKIM en DMARC
Jeffrey Cafferata
 
Keeping DNS server up-and-running with “runit
Men and Mice
 
Yeti DNS - Experimenting at the root
Men and Mice
 
Community tools to fight against DDoS, SANOG 27
APNIC
 
Community tools to fight against DDoS
Fakrul Alam
 
Windows 2012 and DNSSEC
Men and Mice
 
Dns protocol design attacks and security
Michael Earls
 
Linux15 dynamic dns-2
Jainul Musani
 
Linux14 Dynamic DNS
Jainul Musani
 
DNSSEC and DANE – E-Mail security reloaded
Men and Mice
 
DNSTap Webinar
Men and Mice
 
DDoS Attacks : Preparation Detection Mitigation
Fakrul Alam
 
Fighting Email Abuse with DMARC
Kurt Andersen
 
CNIT 40: 2: DNS Protocol and Architecture
Sam Bowne
 
Ad

Similar to Fighting Abuse with DNS (20)

PDF
The not so simple mail transport protocol @dpcon 2018
Jos Elstgeest
 
PDF
Join the fight against email spam! - SweetlakePHP
Jeffrey Cafferata
 
PDF
Join the fight against email spam! - EmmenPHP
Jeffrey Cafferata
 
PDF
An Introduction To The DMARC SMTP Validation Requirements
Gabriella Davis
 
PDF
Electronic_Mail_Attacks-1-35.pdf by xploit
niftliyevhuseyn
 
PPTX
secure-email-domain-name-system-design.pptx
Muhammad Salahuddien
 
PPTX
Network and Internet Security.pptx
Guna Dhondwad
 
PDF
An Introduction To The DMARC SMTP Validation Requirements
Gabriella Davis
 
PPTX
What You Need to Know About Email Authentication
Kurt Andersen
 
PDF
How to use Domino as a Mail Server in a Modern World
Martijn de Jong
 
PDF
Massive emailing with Linux, Postfix and Ruby on Rails
ibelmonte
 
PPTX
Let's go Phishing with Email!
Wesley Kirkland
 
PPTX
DomainKeys Identified Mail (DKIM).pptx
SrijanKumarShetty
 
PPTX
Sender Policy Framework (SPF): An Email Authentication Technique
HTS Hosting
 
PDF
DMARC360 Guide
DMARC360
 
PPTX
SMTP over IPv6 at LinkedIn
Franck Martin
 
PDF
Async os dkim-dmarc-guide
GlDemira
 
PPT
Authentication & Reputation, Adding Business Value In The Real World
jprice
 
PPT
how email works
harikaveeravalli
 
PDF
Rspamd freebsd FOSDEM
Vsevolod Stakhov
 
The not so simple mail transport protocol @dpcon 2018
Jos Elstgeest
 
Join the fight against email spam! - SweetlakePHP
Jeffrey Cafferata
 
Join the fight against email spam! - EmmenPHP
Jeffrey Cafferata
 
An Introduction To The DMARC SMTP Validation Requirements
Gabriella Davis
 
Electronic_Mail_Attacks-1-35.pdf by xploit
niftliyevhuseyn
 
secure-email-domain-name-system-design.pptx
Muhammad Salahuddien
 
Network and Internet Security.pptx
Guna Dhondwad
 
An Introduction To The DMARC SMTP Validation Requirements
Gabriella Davis
 
What You Need to Know About Email Authentication
Kurt Andersen
 
How to use Domino as a Mail Server in a Modern World
Martijn de Jong
 
Massive emailing with Linux, Postfix and Ruby on Rails
ibelmonte
 
Let's go Phishing with Email!
Wesley Kirkland
 
DomainKeys Identified Mail (DKIM).pptx
SrijanKumarShetty
 
Sender Policy Framework (SPF): An Email Authentication Technique
HTS Hosting
 
DMARC360 Guide
DMARC360
 
SMTP over IPv6 at LinkedIn
Franck Martin
 
Async os dkim-dmarc-guide
GlDemira
 
Authentication & Reputation, Adding Business Value In The Real World
jprice
 
how email works
harikaveeravalli
 
Rspamd freebsd FOSDEM
Vsevolod Stakhov
 

More from Men and Mice (20)

PPTX
Cisco Live 2019: New Best Practices for Hybrid and Multicloud Network Strategies
Men and Mice
 
PDF
Part 3 - Local Name Resolution in Linux, FreeBSD and macOS/iOS
Men and Mice
 
PDF
Part 2 - Local Name Resolution in Windows Networks
Men and Mice
 
PDF
Namespaces for Local Networks
Men and Mice
 
PDF
How to send DNS over anything encrypted
Men and Mice
 
PDF
The DNSSEC KSK of the root rolls
Men and Mice
 
PDF
The CAA-Record for increased encryption security
Men and Mice
 
PDF
SMTP STS (Strict Transport Security) vs. SMTP with DANE
Men and Mice
 
PDF
DNSSEC signing Tutorial
Men and Mice
 
PDF
Windows Server 2016 Webinar
Men and Mice
 
PDF
Kea DHCP – the new open source DHCP server from ISC
Men and Mice
 
PDF
RIPE 71 and IETF 94 reports webinar
Men and Mice
 
PDF
PowerDNS Webinar - Part 2
Men and Mice
 
PDF
PowerDNS Webinar
Men and Mice
 
PDF
IETF 93 Review Webinar
Men and Mice
 
PDF
RIPE 70 Report Webinar
Men and Mice
 
PDF
IETF 92 Webinar
Men and Mice
 
PDF
The KNOT DNS Server
Men and Mice
 
PDF
RIPE 69 & IETF 91 Webinar - DNS-Privacy, IPv6, DANE and DHCP(v6)
Men and Mice
 
PDF
IETF 90 Report – DNS, DHCP, IPv6 and DANE
Men and Mice
 
Cisco Live 2019: New Best Practices for Hybrid and Multicloud Network Strategies
Men and Mice
 
Part 3 - Local Name Resolution in Linux, FreeBSD and macOS/iOS
Men and Mice
 
Part 2 - Local Name Resolution in Windows Networks
Men and Mice
 
Namespaces for Local Networks
Men and Mice
 
How to send DNS over anything encrypted
Men and Mice
 
The DNSSEC KSK of the root rolls
Men and Mice
 
The CAA-Record for increased encryption security
Men and Mice
 
SMTP STS (Strict Transport Security) vs. SMTP with DANE
Men and Mice
 
DNSSEC signing Tutorial
Men and Mice
 
Windows Server 2016 Webinar
Men and Mice
 
Kea DHCP – the new open source DHCP server from ISC
Men and Mice
 
RIPE 71 and IETF 94 reports webinar
Men and Mice
 
PowerDNS Webinar - Part 2
Men and Mice
 
PowerDNS Webinar
Men and Mice
 
IETF 93 Review Webinar
Men and Mice
 
RIPE 70 Report Webinar
Men and Mice
 
IETF 92 Webinar
Men and Mice
 
The KNOT DNS Server
Men and Mice
 
RIPE 69 & IETF 91 Webinar - DNS-Privacy, IPv6, DANE and DHCP(v6)
Men and Mice
 
IETF 90 Report – DNS, DHCP, IPv6 and DANE
Men and Mice
 

Recently uploaded (20)

PPTX
Chapter 5: Probability Theory and Statistics
RandyFin
 
PDF
How IoT Sensor Integration in 2025 is Transforming Industries Worldwide
Rejig Digital
 
PDF
Architecture types and enterprise applications.pdf
ChristopherTHyatt
 
PPTX
GROUP4NURSINGINFORMATICSREPORT-2 PRESENTATION
ClarisejaneSartillo1
 
PPTX
Microsoft Excel 365/2024 Beginner's training
frank yeboah
 
PDF
A review of recent deep learning applications in wood surface defect identifi...
IAESIJAI
 
PDF
Comparative analysis of machine learning models for fake news detection in so...
IAESIJAI
 
PDF
Five Habits of High-Impact Board Members
OnBoard
 
PPTX
Custom Battery Pack Design Considerations for Performance and Safety
Epec Engineered Technologies
 
PDF
sustainability-14-14877-v2.pddhzftheheeeee
VenkateshGovindaraja9
 
DOCX
search engine optimization ppt fir known well about this
StandardCodeLearning
 
PDF
ENT215_Completing-a-large-scale-migration-and-modernization-with-AWS.pdf
ssuser28425f
 
PPTX
Configure Apache Mutual Authentication
Antonino Piraino
 
PDF
NewMind AI Weekly Chronicles – August ’25 Week III
NewMind AI
 
PPTX
2018-HIPAA-Renewal-Training for executives
Mayank Mathur
 
PDF
Zenith AI: Advanced Artificial Intelligence
Biz Preneurs
 
PDF
Enhancing plagiarism detection using data pre-processing and machine learning...
IAESIJAI
 
PDF
Flame analysis and combustion estimation using large language and vision assi...
IAESIJAI
 
PPT
Geologic Time for studying geology for geologist
ssuser738f5a
 
PPTX
AI IN MARKETING- PRESENTED BY ANWAR KABIR 1st June 2025.pptx
HiraJay1
 
Chapter 5: Probability Theory and Statistics
RandyFin
 
How IoT Sensor Integration in 2025 is Transforming Industries Worldwide
Rejig Digital
 
Architecture types and enterprise applications.pdf
ChristopherTHyatt
 
GROUP4NURSINGINFORMATICSREPORT-2 PRESENTATION
ClarisejaneSartillo1
 
Microsoft Excel 365/2024 Beginner's training
frank yeboah
 
A review of recent deep learning applications in wood surface defect identifi...
IAESIJAI
 
Comparative analysis of machine learning models for fake news detection in so...
IAESIJAI
 
Five Habits of High-Impact Board Members
OnBoard
 
Custom Battery Pack Design Considerations for Performance and Safety
Epec Engineered Technologies
 
sustainability-14-14877-v2.pddhzftheheeeee
VenkateshGovindaraja9
 
search engine optimization ppt fir known well about this
StandardCodeLearning
 
ENT215_Completing-a-large-scale-migration-and-modernization-with-AWS.pdf
ssuser28425f
 
Configure Apache Mutual Authentication
Antonino Piraino
 
NewMind AI Weekly Chronicles – August ’25 Week III
NewMind AI
 
2018-HIPAA-Renewal-Training for executives
Mayank Mathur
 
Zenith AI: Advanced Artificial Intelligence
Biz Preneurs
 
Enhancing plagiarism detection using data pre-processing and machine learning...
IAESIJAI
 
Flame analysis and combustion estimation using large language and vision assi...
IAESIJAI
 
Geologic Time for studying geology for geologist
ssuser738f5a
 
AI IN MARKETING- PRESENTED BY ANWAR KABIR 1st June 2025.pptx
HiraJay1
 

Fighting Abuse with DNS

  • 1. © Men & Mice http://menandmice,com SPF, DKIM and DMARC Mail-Reputation and DNS Wednesday 26 October 16
  • 2. © Men & Mice http://menandmice,com Sender Policy Framework Wednesday 26 October 16
  • 3. © Men & Mice http://menandmice,com SPF •Sender Policy Framework (SPF) defines the addresses mails can be originated for a given domain •this information is stored in it’s own SPF-Format inside a TXT-Record • there has been a dedicated SPF record type, that has been deprecated because it was ignored by Mail- and DNS-admins •Website: http://www.openspf.org Wednesday 26 October 16
  • 4. © Men & Mice http://menandmice,com SPF-Example •the Google SPF-Record google.com. 3600 IN TXT "v=spf1 include:_spf.google.com ~all" Mail-Sender Domain SPF-Format Version Include SPF- Information from subdomain Soft-Fail SPF- Checks Wednesday 26 October 16
  • 5. © Men & Mice http://menandmice,com SPF-Example •the Google SPF-Record _spf.google.com. 299 INTXT "v=spf1 include:_netblocks.google.com include:_netblocks2.google.com include:_netblocks3.google.com ~all" Includes of Google Network Blocks Wednesday 26 October 16
  • 6. © Men & Mice http://menandmice,com SPF-Example •the Google SPF-Record _spf.google.com. 299 INTXT "v=spf1 include:_netblocks.google.com include:_netblocks2.google.com include:_netblocks3.google.com ~all" Includes of Google Network Blocks Wednesday 26 October 16
  • 7. © Men & Mice http://menandmice,com SPF-Example •the Google SPF-Record _netblocks.google.com. 3600 IN TXT "v=spf1 ip4:64.18.0.0/20 ip4:64.233.160.0/19 ip4:66.102.0.0/20 ip4:66.249.80.0/20 ip4:72.14.192.0/18 ip4:74.125.0.0/16 ip4:108.177.8.0/21 ip4:173.194.0.0/16 ip4:207.126.144.0/20 ip4:209.85.128.0/17 ip4:216.58.192.0/19 ip4:216.239.32.0/19 ~all" Google Mail-Sending addresses Wednesday 26 October 16
  • 8. © Men & Mice http://menandmice,com SPF-Operation example.com authoritative DNS example.com outgoing mail receiving mail server sending mail on port 25 from 192.0.2.123 Wednesday 26 October 16
  • 9. © Men & Mice http://menandmice,com SPF-Operation example.com authoritative DNS example.com outgoing mail receiving mail server sending mail on port 25 from 192.0.2.123 looking up SPF-Record for “example.com” Wednesday 26 October 16
  • 10. © Men & Mice http://menandmice,com SPF-Operation example.com authoritative DNS example.com outgoing mail receiving mail server sending mail on port 25 from 192.0.2.123 example.com IN TXT “v=spf1 ipv4:192.0.2.0/24 -all” Wednesday 26 October 16
  • 11. © Men & Mice http://menandmice,com SPF-Operation example.com authoritative DNS example.com outgoing mail receiving mail server sending mail on port 25 from 192.0.2.123 check if sending address is within SPF- Data Wednesday 26 October 16
  • 12. © Men & Mice http://menandmice,com SPF-Operation example.com authoritative DNS example.com outgoing mail receiving mail server mail has been received Wednesday 26 October 16
  • 13. © Men & Mice http://menandmice,com SPF issues •SPF is problematic with some mail functions where mail is send indirectly •mail-forwarding •mailing lists •webforms - http://bsdly.blogspot.nl/2016/10/is-spf-simply-too-hard-for-application.html Wednesday 26 October 16
  • 14. © Men & Mice http://menandmice,com SPF problem with forwarding example.com authoritative DNS example.com outgoing mail receiving mail server mailing-list server sending mail from user@example.com on port 25 from 192.0.2.123 Wednesday 26 October 16
  • 15. © Men & Mice http://menandmice,com SPF problem with forwarding example.com authoritative DNS example.com outgoing mail receiving mail server mailing-list server sending mail from user@example.com on port 25 from 203.0.113.23 Wednesday 26 October 16
  • 16. © Men & Mice http://menandmice,com SPF problem with forwarding example.com authoritative DNS example.com outgoing mail receiving mail server mailing-list server sending mail from user@example.com on port 25 from 203.0.113.23 looking up SPF-Record for “example.com” Wednesday 26 October 16
  • 17. © Men & Mice http://menandmice,com SPF problem with forwarding example.com authoritative DNS example.com outgoing mail receiving mail server mailing-list server sending mail from user@example.com on port 25 from 203.0.113.23 example.com IN TXT “v=spf1 ipv4:192.0.2.0/24 -all” Wednesday 26 October 16
  • 18. © Men & Mice http://menandmice,com SPF problem with forwarding example.com authoritative DNS example.com outgoing mail receiving mail server mailing-list server sending mail from user@example.com on port 25 from 203.0.113.23 check if sending address is within SPF- Data Wednesday 26 October 16
  • 19. © Men & Mice http://menandmice,com SPF problem with forwarding example.com authoritative DNS example.com outgoing mail receiving mail server mailing-list server sending mail from user@example.com on port 25 from 203.0.113.23 mail rejected, as the sender IP does not appear in the SPF data Wednesday 26 October 16
  • 20. © Men & Mice http://menandmice,com SPF problem with forwarding example.com authoritative DNS example.com outgoing mail receiving mail server mailing-list server sending mail from user@example.com on port 25 from 203.0.113.23 mail rejected, as the sender IP does not appear in the SPF data Wednesday 26 October 16
  • 21. © Men & Mice http://menandmice,com DKIM DomainKeys Identified Mail Wednesday 26 October 16
  • 22. © Men & Mice http://menandmice,com DKIM • DKIM cryptographically signs selected mail headers and the mail content • DKIM is used to validate the mail message content but not to secure the transport path • No upgrade to User Client (Client E-Mail program) needed • But E-Mail Clients can offer per-User signing, as an option • DKIM Management can be “outsourced” (ISP, E-Mail Hosting Provider) • No PKI Infrastructure needed, only depends on DNS Wednesday 26 October 16
  • 23. © Men & Mice http://menandmice,com DKIM • DKIM Website • http://dkim.org/ • Documents • RFC 5585 - DomainKeys Identified Mail (DKIM) Service Overview https://tools.ietf.org/html/rfc5585 • RFC 6376 - DomainKeys Identified Mail (DKIM) Signatures https://tools.ietf.org/html/rfc6376 • RFC 5863 - DomainKeys Identified Mail (DKIM) Development, Deployment, and Operations https://tools.ietf.org/html/rfc5863 • RFC 5617 - DomainKeys Identified Mail (DKIM) Author Domain Signing Practices (ADSP) https://tools.ietf.org/html/rfc5617 • RFC 6377 - DomainKeys Identified Mail (DKIM) and Mailing Lists https://tools.ietf.org/html/rfc6377 Wednesday 26 October 16
  • 24. © Men & Mice http://menandmice,com DKIM Signature in the Mail Header DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mennogmys.onmicrosoft.com; s=selector1-menandmice-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=Rk04UQbu8aZGogweVSHLqo55rIPXR0OajjGVpZOcEic=; b=cVQyry/E2yMiV9qUZbth0Y51r5OoWoHPr0qYklZYGvc6/[...] DKIM Version Wednesday 26 October 16
  • 25. © Men & Mice http://menandmice,com DKIM Signature in the Mail Header DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mennogmys.onmicrosoft.com; s=selector1-menandmice-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=Rk04UQbu8aZGogweVSHLqo55rIPXR0OajjGVpZOcEic=; b=cVQyry/E2yMiV9qUZbth0Y51r5OoWoHPr0qYklZYGvc6/[...] DKIM Signing Algorithm Wednesday 26 October 16
  • 26. © Men & Mice http://menandmice,com DKIM Signature in the Mail Header DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mennogmys.onmicrosoft.com; s=selector1-menandmice-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=Rk04UQbu8aZGogweVSHLqo55rIPXR0OajjGVpZOcEic=; b=cVQyry/E2yMiV9qUZbth0Y51r5OoWoHPr0qYklZYGvc6/[...] canonicalization algorithm: "relaxed" algorithm that tolerates common modifications such as whitespace replacement and header field line rewrapping Wednesday 26 October 16
  • 27. © Men & Mice http://menandmice,com DKIM Signature in the Mail Header DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mennogmys.onmicrosoft.com; s=selector1-menandmice-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=Rk04UQbu8aZGogweVSHLqo55rIPXR0OajjGVpZOcEic=; b=cVQyry/E2yMiV9qUZbth0Y51r5OoWoHPr0qYklZYGvc6/[...] Domain of the sending party, this is where the public key to verify the signature is located Wednesday 26 October 16
  • 28. © Men & Mice http://menandmice,com DKIM Signature in the Mail Header DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mennogmys.onmicrosoft.com; s=selector1-menandmice-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=Rk04UQbu8aZGogweVSHLqo55rIPXR0OajjGVpZOcEic=; b=cVQyry/E2yMiV9qUZbth0Y51r5OoWoHPr0qYklZYGvc6/[...] Subdomain selector: will pre prepended to the domain to fetch the DKIM public key Wednesday 26 October 16
  • 29. © Men & Mice http://menandmice,com Fetching the DKIM key •The DKIM public key can be found inside a TXT record at a domain name build from • selector • subdomain “_domainkey” • base mail domain (d: field) $ dig selector1-menandmice-com._domainkey.mennogmys.onmicrosoft.com TXT +short "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDenG16IONFpDPACAhDnCd/ N98W277rSbwSoatar767pSYtT+CClFqhmEePynSVGdS0RxIjFZscmVN5RZjnfD +HE1HL4XvUtxnnb1j0PeNfhrDHy7BHFGux6exfL7/splByKu7qhLBP10+SyAjiE4Qc6xWfCQ3MzmECZGW/ CzzmOQIDAQAB; n=1024,1450909615,1" Wednesday 26 October 16
  • 30. © Men & Mice http://menandmice,com DKIM Signature in the Mail Header DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mennogmys.onmicrosoft.com; s=selector1-menandmice-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=Rk04UQbu8aZGogweVSHLqo55rIPXR0OajjGVpZOcEic=; b=cVQyry/E2yMiV9qUZbth0Y51r5OoWoHPr0qYklZYGvc6/[...] Header-Fields signed by the sending party Wednesday 26 October 16
  • 31. © Men & Mice http://menandmice,com DKIM Signature in the Mail Header DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mennogmys.onmicrosoft.com; s=selector1-menandmice-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=Rk04UQbu8aZGogweVSHLqo55rIPXR0OajjGVpZOcEic=; b=cVQyry/E2yMiV9qUZbth0Y51r5OoWoHPr0qYklZYGvc6/[...] Body-Hash: Hash of the message body Wednesday 26 October 16
  • 32. © Men & Mice http://menandmice,com DKIM Signature in the Mail Header DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mennogmys.onmicrosoft.com; s=selector1-menandmice-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=Rk04UQbu8aZGogweVSHLqo55rIPXR0OajjGVpZOcEic=; b=cVQyry/E2yMiV9qUZbth0Y51r5OoWoHPr0qYklZYGvc6/[...] Signature over header fields and Body-Hash Wednesday 26 October 16
  • 33. © Men & Mice http://menandmice,com DKIM operation example.com authoritative DNS example.com outgoing mail receiving mail server mail forwarder mail get signed with “example.com” private DKIM key Wednesday 26 October 16
  • 34. © Men & Mice http://menandmice,com DKIM operation example.com authoritative DNS example.com outgoing mail receiving mail server mail forwarder sending mail from user@example.com on port 25 from 192.0.2.123 Wednesday 26 October 16
  • 35. © Men & Mice http://menandmice,com SPF problem with forwarding example.com authoritative DNS example.com outgoing mail receiving mail server sending mail from user@example.com on port 25 from 203.0.113.23 mail forwarder Wednesday 26 October 16
  • 36. © Men & Mice http://menandmice,com SPF problem with forwarding example.com authoritative DNS example.com outgoing mail receiving mail server sending mail from user@example.com on port 25 from 203.0.113.23 looking up DKIM public key for “example.com” mail forwarder Wednesday 26 October 16
  • 37. © Men & Mice http://menandmice,com SPF problem with forwarding example.com authoritative DNS example.com outgoing mail receiving mail server sending mail from user@example.com on port 25 from 203.0.113.23 _domainkeys.example.com IN TXT “v=DKIM1; k=rsa; p=MIG[...]” mail forwarder Wednesday 26 October 16
  • 38. © Men & Mice http://menandmice,com SPF problem with forwarding example.com authoritative DNS example.com outgoing mail receiving mail server sending mail from user@example.com on port 25 from 203.0.113.23 validating DKIM signed headers and body mail forwarder Wednesday 26 October 16
  • 39. © Men & Mice http://menandmice,com SPF problem with forwarding example.com authoritative DNS example.com outgoing mail receiving mail server mailing-list server mail has been received Wednesday 26 October 16
  • 40. © Men & Mice http://menandmice,com DMARC Domain-based Message Authentication, Reporting & Conformance Wednesday 26 October 16
  • 41. © Men & Mice http://menandmice,com DMARC •DMARC builds on top of SPF and DKIM •it allows the owner of an email domain to publish a policy about SPF and DKIM failures •DMARC can be used to publish a feedback channel to let the domain owner know of spoofed mail from his domain •the DMARC policy is stored in DNS Wednesday 26 October 16
  • 42. © Men & Mice http://menandmice,com DMARC •example DMARC record "v=DMARC1;p=reject;pct=100;rua=mailto:postmaster@example.com" Protocol Version Wednesday 26 October 16
  • 43. © Men & Mice http://menandmice,com DMARC •example DMARC record "v=DMARC1;p=reject;pct=100;rua=mailto:postmaster@example.com" Policy for organizational domain Wednesday 26 October 16
  • 44. © Men & Mice http://menandmice,com DMARC •example DMARC record "v=DMARC1;p=reject;pct=100;rua=mailto:postmaster@example.com" Percentage of messages subjected to filtering Wednesday 26 October 16
  • 45. © Men & Mice http://menandmice,com DMARC •example DMARC record "v=DMARC1;p=reject;pct=100;rua=mailto:postmaster@example.com" Where to send the aggregated mis-use reports Wednesday 26 October 16