Dev May Cry

Posted on Oct 30

Anyone can write “From: bank.com” in an email. Here’s how Gmail catches the fake.

#cybersecurity #networking #security

TL;DR: SMTP was born in 1982 with no sender check. Today Gmail runs 3 checks before an email reaches your inbox: SPF, DKIM and DMARC. SPF and DKIM alone are not enough. DMARC is what stops the scam.

Let's follow one fake email from "bank.com" to João, step by step.

1. Every email has two senders

Think of a real letter. The envelope is what the mail carrier reads. The letter inside has the "From:" that you read. Email works the same way:

MAIL FROM: (the envelope) is only read by servers
From: (the letter) is what you see in your inbox

A scammer can put a different name in each one.

2. SPF (Sender Policy Framework): who is allowed to send?

It's a list in DNS with the servers that can send email for a domain.

$ dig TXT bank.com
v=spf1 include:amazonses.com -all

The scammer's server is not on the list, so SPF fails. Note: SPF only checks the envelope.

3. DKIM (DomainKeys Identified Mail): was the email signed?

The sending server signs the email with a private key. Gmail gets the public key from DNS and checks the signature. If anyone changes the text, the signature breaks. The d= tag shows who signed it.

4. The trick: the scammer uses his own domain

MAIL FROM:<x@scam.com>   spf=pass  (scam.com)
DKIM d=scam.com          dkim=pass (scam.com)
From: support@bank.com   <- João sees this

Both checks pass, but for the wrong domain.

5. DMARC: do the names match?

DMARC = Domain-based Message Authentication, Reporting and Conformance.

It asks whether the domain in From: is the same domain that passed SPF or DKIM. This is called alignment. Here scam.com ≠ bank.com, so DMARC fails.

6. The domain owner decides what happens

_dmarc.bank.com  TXT  "v=DMARC1; p=reject"

p=none → only watch
p=quarantine → send to spam
p=reject → refuse the email

The bank also gets reports about who is trying to use its name.

Without DMARC

Gmail has no rule to apply, and the fake email can land in João's inbox. That's why Gmail and Yahoo have required DMARC since 2024 for anyone who sends more than 5,000 emails per day.

Test your domain

dig TXT _dmarc.yourdomain.com

Sources: RFC 7208 (SPF), RFC 6376 (DKIM), RFC 7489 (DMARC)

Does your domain already have DMARC?

DEV Community