Jet Mariano

Tag: DKIM

  • DKIM Security: How Signing and Key Rotation Stop Email Spoofing

    Introduction

    DKIM (DomainKeys Identified Mail) is one of the most effective ways to verify that an email truly came from your organization. But many companies misunderstand one crucial truth:

    DKIM is only as strong as the protection of its private key.

    If attackers obtain your DKIM private key, they can sign email that appears cryptographically legitimate — even if it comes from a malicious server. This is why key length, rotation, and protection matter just as much as turning DKIM “on.”

    Section 1 — What DKIM Actually Does

    DKIM works by attaching a digital signature to every outbound message.
    It ensures:

    • The message hasn’t been altered
    • The sender is authorized
    • The domain identity can be verified

    The core elements are:

    1️⃣ DKIM Selector (s=)

    Identifies which key is used.
    Example:
    s=mail2025;

    2️⃣ DKIM Domain (d=)

    The domain signing the message.
    Example:
    d=example-corp-secure.com;

    3️⃣ Public Key (Published in DNS)

    Stored in a TXT record:
    mail2025._domainkey.example-corp-secure.com

    4️⃣ Private Key (kept hidden on the mail server)

    This is the key attackers target.
    It signs every outbound message.

    Section 2 — Why Private Keys Must Be 2048-bit Minimum

    Attackers today can break 1024-bit DKIM keys.

    • Cloud computing
    • GPU farms
    • Distributed cracking

    This is why Microsoft and major ESPs recommend 2048-bit keys.

    Weak DKIM = forged trust.

    Section 3 — Why You Must Rotate DKIM Keys Regularly

    Even a strong key becomes weaker over time:

    • Keys leak
    • Keys get copied
    • Keys get exposed in old backups
    • Misconfigured systems reuse keys
    • Bad actors gather DNS data for months

    Weekly or monthly rotation is considered best practice in regulated industries like banking.

    Rotation protects your domain even if an attacker manages to obtain an older key.

    Section 4 — How an Attacker Exploits DKIM

    If the private key is stolen:

    • They can sign malware
    • They can sign phishing
    • They bypass SPF failures
    • They pass DKIM alignment
    • They pass DMARC alignment
    • Email goes straight to inbox

    This is why DKIM alone is not enough.

    Section 5 — Why DKIM Matters

    • Prevents email tampering
    • Builds domain trust
    • Enables DMARC “reject” mode
    • Protects your brand
    • Reduces false positives
    • Ensures message integrity

    But DKIM is only strong if the private key is protected and rotated.

    Conclusion

    Most executives think DKIM is “set it and forget it.”
    But email security today requires:

    • Strong 2048-bit DKIM keys
    • Regular rotation
    • Tight private key protection
    • Monitoring through Proofpoint and EOP
    • DMARC enforcement

    This is not optional anymore — especially for banks.

    © 2012–2025 Jet Mariano. All rights reserved.
    For usage terms, please see the Legal Disclaimer.

  • DMARC (Domain-based Message Authentication, Reporting & Conformance)

    Introduction

    DMARC (Domain-based Message Authentication, Reporting & Conformance) is the control system that tells receiving email servers what to do when a message fails SPF or DKIM. Without DMARC, attackers can spoof your domain freely.

    Section 1 — What DMARC Does

    DMARC:

    • Protects your domain from spoofing
    • Defines how mail servers should handle failures
    • Provides visibility into fraud attempts
    • Supports brand protection
    • Enables full enforcement (“p=reject”)

    Section 2 — DMARC Tags and Their Meaning

    1️⃣ v=DMARC1

    Protocol version. Always DMARC1.

    2️⃣ p= (Policy)

    Tells receiving servers what to do:

    • p=none → Monitor only
    • p=quarantine → Send failures to spam
    • p=reject → Block failures entirely (best practice for banks)

    3️⃣ rua= (Aggregate Reports)

    Where daily XML reports are delivered.
    Example:
    rua=mailto:[email protected]

    4️⃣ ruf= (Forensic Reports)

    Receives detailed failure samples (PII-sensitive).
    Example:
    ruf=mailto:[email protected]

    5️⃣ fo= (Failure Options)

    Controls what triggers forensic reporting.
    Common:
    fo=1 → Send forensic report on any SPF/DKIM failure.

    Section 3 — Example of a DMARC Record

    v=DMARC1;
p=reject;
rua=mailto:[email protected];
ruf=mailto:[email protected];
fo=1;
adkim=s;
aspf=s;

    adkim=s and aspf=s enforce strict alignment — critical for banks and regulated industries.

    Section 4 — Why DMARC Matters

    • Blocks domain impersonation
    • Reduces malware/phishing impact
    • Protects customers from fraud
    • Shields executives from spoofing
    • Enables brand trust
    • Essential for financial institutions

    Conclusion

    A strong DMARC policy (“reject”) is one of the strongest defenses against email spoofing — but only when SPF and DKIM are configured properly and regularly monitored.

    © 2012–2025 Jet Mariano. All rights reserved.
    For usage terms, please see the Legal Disclaimer.

  • Email Spoofing Explained: How Attackers Do It and How DMARC Blocks Them

    Introduction

    Email is built on trust — and the original SMTP protocol (from 1982) was never designed with modern threat actors in mind. Attackers now exploit loose RFC rules, misconfigured servers, and public DNS to spoof legitimate senders and bypass basic filtering.

    This blog explains how spoofing actually works, why SPF/DKIM alone are not enough, and why DMARC alignment + Proofpoint is essential for stopping real-world business email compromise (BEC) attacks.

    1. Email Spoofing 101 — Why SMTP Allows It

    SMTP does not validate who the sender truly is.
    An attacker can control:

    a) The SMTP Envelope (“MAIL FROM”)

    Used for return-path, bounce messages, and SPF checks.

    b) The Email Header (“From:”)

    What the human sees in Outlook, Gmail, iPhone Mail.

    Both can be forged.
    That means an attacker can send:

    MAIL FROM: <[email protected]>
From: Jane Doe <[email protected]>

    …even though they do not own that domain.

    2. Step-by-Step: How Attackers Use SMTP to Forge Email

    (Everything below uses neutral demonstration domains to avoid referencing any real organization.)

    S: 220 mail.fake-sender.net SMTP Ready
C: HELO mail.fake-sender.net
S: 250 Hello
C: MAIL FROM:<[email protected]>
S: 250 OK
C: RCPT TO:<[email protected]>
S: 250 Accepted
C: DATA
S: 354 Start mail input
C: Subject: Urgent – Please Review
C: From: [email protected]
C: To: [email protected]

Hi Bob,
Please review this document:
https://malicious-link-example.net/file

Thanks,
Jane
C: .
S: 250 Message accepted
C: QUIT
S: 221 Goodbye

    Important:
    This is exactly how attackers craft spoofed email — the same RFC-compliant commands a normal email client uses.

    3. How Attackers “Harvest” SPF and DKIM Using DNS

    Attackers don’t guess your DNS settings.
    They simply query them publicly, like anyone else on the internet.

    Example: Retrieving DKIM Keys

    nslookup -type=txt selector1._domainkey.victim-of-spoofing.com

    This returns the DKIM public key, which attackers use to craft more believable spoofing attempts (not to break DKIM, but to mimic structure).

    Example: Retrieving SPF Records

    nslookup -type=txt victim-of-spoofing.com

    Result:

    "v=spf1 include:_spf.example-email.net -all"

    Attackers now know:

    • what legitimate sending systems you use
    • how strict your SPF policy is
    • which vendors to impersonate

    SPF & DKIM are public, and attackers rely on that.

    4. Why SPF and DKIM Alone Are Not Enough

    SPF checks the envelope (MAIL FROM).
    DKIM checks the message integrity.

    But both fail in these common scenarios:

    SPF Fails When:

    • A scammer spoofs only the header From
    • Email is forwarded
    • Attackers use free SMTP servers with permissive policies

    DKIM Fails When:

    • Sender uses a domain with no DKIM at all
    • Attackers spoof domains they do own
    • Emails pass through weak relays

    This is why companies get spoofed even with “perfect” SPF/DKIM.

    5. DMARC Alignment — The Real Line of Defense

    DMARC requires:

    ✔ SPF Alignment

    Envelope domain must match header From domain.

    ✔ DKIM Alignment

    DKIM signature domain must match the header From.

    If neither aligns, DMARC instructs receivers to:

    • none — monitor only
    • quarantine — send to spam
    • reject — block outright

    Reject is where spoofing finally dies.

    6. Two Ways Attackers Deliver Spoofed Email

    This is critical for interview-level mastery:

    1️⃣ Using Their Own SMTP Server

    Attackers set up a server where:

    • they control all DNS
    • they can configure any RFC behavior
    • they can impersonate any domain

    This allows highly believable spoofing.

    2️⃣ Using Vulnerable Third-Party SMTP Servers

    Attackers often search for:

    • misconfigured mail relays
    • open SMTP relays
    • free spoofing services

    Both methods work unless DMARC reject + Proofpoint is in place.

    7. Why Proofpoint Completes the Protection

    Even with DMARC reject, attackers still spoof:

    • VIP names (“Display Name Spoofing”)
    • Lookalike domains (e.g., companny-secure.com)
    • Legitimate cloud providers that DMARC trusts
    • OAuth-compromised accounts (EAC)

    Proofpoint adds:

    • Identity threat intelligence
    • Imposter protection (BEC Defense)
    • Lookalike domain analysis
    • Behavioral anomaly detection
    • URL rewriting + sandboxing
    • Real-time classification

    Without Proofpoint, DMARC is only half of the defense.

    Conclusion

    Attackers rely on the weaknesses of SMTP’s original design, public DNS records, and domains they control. That’s why spoofing is still one of the most common and dangerous forms of cyberattack worldwide.

    The only way to fully protect executives, employees, and customers is:

    ✔ SPF
    ✔ DKIM
    ✔ DMARC (reject)
    ✔ PLUS Proofpoint’s identity + behavioral controls

    This is the combination that stops real-world BEC/EAC attacks.

    © 2012–2025 Jet Mariano. All rights reserved.
    For usage terms, please see the Legal Disclaimer.

error: Content is protected !!