This was a recent problem with Cloudflares partnership with MailChannels[1] that allowed email spoofing which was related to this.
The basic problem being that mailchannel did not require authentication - cloudflare workers could just hit an API endpoint on mailchannel to send email. Mailchannel required you to add an include: record to your SPF policy. This allowed anyone to impersonate anyone else due to mailchannel being a valid sender for all domains.
Only ~400 domains of the 2M hosted had DKIM set up but even if they did the passing SPF caused DMARC to pass.
Appreciate the skepticism; it keeps us on our toes. Let's cut to the chase:
Domain Lockdown: We added this to our Cloudflare Workers integration. It mandates a DNS TXT record to authorize a Worker to send emails from a specific domain. You can't forge the CF-Worker header, so impersonation is off the table.
Pre-Lockdown Vulnerability: Yes, we were more exposed before. Thanks to the researchers who pointed it out, we've patched this up with Domain Lockdown.
SMTP Relay & Web Hosting: Domain Lockdown isn’t mandatory yet in the rest of our service for the web hosting industry. But we’re developing updates for our cPanel WHM plugin and other integrations to make this scalable for millions of domains. Note that our service has to work for applications like public mailing lists where locking the sender domain down breaks stuff.
Scale & Standardization: We service a broad range of configurations. Rolling out universal changes takes time. We're also working with industry groups like M3AAWG to push for improvements to DMARC and other standards to help everyone be more secure.
I didn't mean anything negative towards MailChannels - I know this is a weak link in the chain for many people. I did know it was resolved and I should have mentioned that but I couldn't figure out the search query to find that post.
I mean i dont think requiring dkim would stop attacks based on totally broken authentication. In that scenario, mailchimp might as well be signing the emails for the incorrect domain as well.
I think its unambiguous. If they want "and/or" to just mean inclusive or why not just use "or". Its shorter, simpler, easier to understand. I also feel "and/or" in general usually means either option are possible/acceptable.
The point I was making is that "DMARC passes if DKIM _and_ SPF passes" and "DMARC passes if DKIM _or_ SPF passes" are both true - you can't specify "DMARC passes if, and only if, DKIM _and_ SPF passes"
I agree the statement "DMARC passes if SPF (inclusive or) DKIM passes"
I was only trying to point out that "and/or" is ambiguous (which we agree, and Wikipedia even agrees - 2 paragraphs for a defintion, 5 paragraphs of criticism) and one of those ambiguities is thinking it means logical AND - which is something DMARC does not do.
Using just "or" would have been fine and conveyed the same meaning as it does now.
And if you use IP address literals instead of paying for a domain, you get a free SPF:
If the "From:"/"Reply-To:" fields contains only the email address with the IP address literal, you get your "SPF" and it gets a much better score in order to avoid grey listing for the first transaction. And if there are no URLs in the content, even better.
Comments
Very cool.
AFAIK this is incorrect.
It is not "and/or" but rather "or" - only DKIM or SPF needs to pass. There is no method to require both.
This was a recent problem with Cloudflares partnership with MailChannels[1] that allowed email spoofing which was related to this.
The basic problem being that mailchannel did not require authentication - cloudflare workers could just hit an API endpoint on mailchannel to send email. Mailchannel required you to add an include: record to your SPF policy. This allowed anyone to impersonate anyone else due to mailchannel being a valid sender for all domains.
Only ~400 domains of the 2M hosted had DKIM set up but even if they did the passing SPF caused DMARC to pass.
[1] https://blog.cloudflare.com/sending-email-from-workers-with-...
Appreciate the skepticism; it keeps us on our toes. Let's cut to the chase:
Domain Lockdown: We added this to our Cloudflare Workers integration. It mandates a DNS TXT record to authorize a Worker to send emails from a specific domain. You can't forge the CF-Worker header, so impersonation is off the table.
Pre-Lockdown Vulnerability: Yes, we were more exposed before. Thanks to the researchers who pointed it out, we've patched this up with Domain Lockdown.
SMTP Relay & Web Hosting: Domain Lockdown isn’t mandatory yet in the rest of our service for the web hosting industry. But we’re developing updates for our cPanel WHM plugin and other integrations to make this scalable for millions of domains. Note that our service has to work for applications like public mailing lists where locking the sender domain down breaks stuff.
Scale & Standardization: We service a broad range of configurations. Rolling out universal changes takes time. We're also working with industry groups like M3AAWG to push for improvements to DMARC and other standards to help everyone be more secure.
Tech docs for the curious: https://support.mailchannels.com/hc/en-us/articles/456589835...
Appreciate all the questions and criticism here. reply
Thank you for the transparency and the update.
I didn't mean anything negative towards MailChannels - I know this is a weak link in the chain for many people. I did know it was resolved and I should have mentioned that but I couldn't figure out the search query to find that post.
No worries. My initial response was horrible; trying to do better.
I mean i dont think requiring dkim would stop attacks based on totally broken authentication. In that scenario, mailchimp might as well be signing the emails for the incorrect domain as well.
True. MailChannels, not MailChip though. They handle email for a lot of webhosting providers.
I think you are just misparsing their grammer. I believe and/or just means inclusive or. It does not mean "and" is neccesarily an option.
I think its unambiguous. If they want "and/or" to just mean inclusive or why not just use "or". Its shorter, simpler, easier to understand. I also feel "and/or" in general usually means either option are possible/acceptable.
The point I was making is that "DMARC passes if DKIM _and_ SPF passes" and "DMARC passes if DKIM _or_ SPF passes" are both true - you can't specify "DMARC passes if, and only if, DKIM _and_ SPF passes"
The english language being ambigious or not making sense is not a new issue. All i know, is i almost always see "and/or" used to mean inclusive or.
Also the dictionary seems to agree it means inclusive or: https://en.m.wiktionary.org/wiki/and/or
I agree the statement "DMARC passes if SPF (inclusive or) DKIM passes"
I was only trying to point out that "and/or" is ambiguous (which we agree, and Wikipedia even agrees - 2 paragraphs for a defintion, 5 paragraphs of criticism) and one of those ambiguities is thinking it means logical AND - which is something DMARC does not do.
Using just "or" would have been fine and conveyed the same meaning as it does now.
Dunno why you're being downvoted, you're correct that it's only "or".
And if you use IP address literals instead of paying for a domain, you get a free SPF:
If the "From:"/"Reply-To:" fields contains only the email address with the IP address literal, you get your "SPF" and it gets a much better score in order to avoid grey listing for the first transaction. And if there are no URLs in the content, even better.
But that is common sense.