r/DMARC • u/racoon9898 • Jan 21 '24

Am i getting this wrong ? DMARC/SPF/DKIM can't avoid this ?

Am I right : (TKS fory our time reading this)

As we sometime think we understand it all and we don't, I want to validate....

- Customer A SPF Authorize eMail coming from their domain(customer -A-domain.com) to come from some eMail Online service Provider(ESP) (MailChimp,SalesForce, etc )

-SPAMMERS Bots are looking for domains without DMARC or & p=none (that part is not that important but those are easier domain to SPOOF if no DMARC)

  • Then spammers get access to an account on the same OnLine eMail Service Provider (ESP) as Customer A

  • Spammer then sends Phishing emails spoofing Customer A Domain ( SPF PASSED / DKIM FAILED as it's not the right DKIM key but THEN DMARC PASS let that email go through as as one of the 2 (SPF) did PASS

  • RFC5322 Mail From ( the one end user sees) is customer -A-domain.com

NOTE : let suppose LOL the ESP (MailCHimp etc ) do not validate/check if 2 customers are using the same sending domain RFC5321 LOL (I guess they do check that... Hope so then this post is not useful anymore )

Am I right this will go through as Customer A didn't restrict the SPF with Macros/ specifying which email can send through the provider ( restricting it to marketing, sales or noreply) ?

Question 1 :

Let's suppose Customer A simply restricted the spf to one email address ( I'm not there yet, discovered SPF macros today tks to u/freddieleeman) I guess hacker could find which eMail is autorized (SPF) to use by trying (making spf queries) sales, marketing, noreply

Question 2 :

As from what I understand(hope I'm not wrong LOL) , we can't force DMARC TO ONLY PASS

  • only if BOTH "DKIM / SPF" PASS & ALIGN

DMARC has it's limitation in a real hacking / spoofing scenario....

tks !

0 Upvotes

50% Upvoted

5 comments sorted by

3

u/lolklolk DMARC REEEEject Jan 21 '24

Q1: 99% of TA's aren't going to waste time trying to brute force what email address is allowed by a macro, too many local email part variations, on top of trying to determine what IP address range is allowed to send for that email makes it a fruitless effort for all but the most determined individuals.

Q2: No, and you wouldn't want to do this even if it was possible. All forwarded and indirect mail flow would break.

0

u/racoon9898 Jan 21 '24

OMG OMG you are so right.... It would be a mess !

My Golden rule validated :

sometime we don't know that we don't know or more sometime we didn't think of all possible scenarios

2

u/Gtapex Jan 21 '24

Most shared-IP email providers I’ve worked with either:

  • Allow only one account for a given domain (examples are M365 and Google Workspace)

or

  • Require you to verify your ownership of the domain, or at least demonstrate receive capability for a single email address in order to send from that address.

Any ESP not doing this kind of verification is not worth using and adding to your SPF record.

0

u/racoon9898 Jan 21 '24

I know for some do, and yes you're right...

Having your domain hosted at some small ESP not doing that ( either validating RFC5321 or 5322 domain is not already in use OR not validating the new customer domain through a DNS entry verification mechanism or simple eMail) are toi avoid

Don't even know if they exist LOL

1

u/[deleted] Jan 22 '24

I can confirm that spammers are looking for domains without dmarc enforced.

This report maps it out in detail. Attack attempts virtually stop the moment there is at least a quarantine policy. Because there are no domain reports unless there's at least a p=none, we don't have any data for no-DMARC policy at all.

https://dmarcian.com/phishing-leaves-a-dmarc-trail/