Fighting Abuse with DNS

© Men & Mice http://menandmice,com

SPF, DKIM and DMARC

Mail-Reputation and DNS

Wednesday 26 October 16

http://www.menandmice.com



Sender Policy Framework





SPF

•Sender Policy Framework (SPF) defines the addresses mails can be originated for a given domain

•this information is stored in it’s own SPF-Format inside a TXT-Record

• there has been a dedicated SPF record type, that has been deprecated because it was ignored by Mail- and DNS-admins

•Website: http://www.openspf.org




http://www.openspf.org

http://www.openspf.org


SPF-Example

•the Google SPF-Record

google.com. 3600 IN TXT "v=spf1 include:_spf.google.com ~all"

Mail-Sender Domain

SPF-FormatVersion

Include SPF-Information from

subdomain

Soft-Fail SPF-Checks





SPF-Example


_spf.google.com. 299 IN TXT "v=spf1 include:_netblocks.google.com include:_netblocks2.google.com include:_netblocks3.google.com ~all"

Includes of Google Network Blocks





SPF-Example


_netblocks.google.com. 3600 IN TXT "v=spf1 ip4:64.18.0.0/20 ip4:64.233.160.0/19 ip4:66.102.0.0/20 ip4:66.249.80.0/20 ip4:72.14.192.0/18 ip4:74.125.0.0/16 ip4:108.177.8.0/21 ip4:173.194.0.0/16 ip4:207.126.144.0/20 ip4:209.85.128.0/17 ip4:216.58.192.0/19 ip4:216.239.32.0/19 ~all"

Google Mail-Sending addresses





SPF-Operation

example.comauthoritative

DNS

example.comoutgoingmail

receiving mail server

sending mailon port 25

from 192.0.2.123





SPF-Operation


DNS




from 192.0.2.123

looking up SPF-Recordfor “example.com”





SPF-Operation


DNS




from 192.0.2.123

example.com IN TXT “v=spf1 ipv4:192.0.2.0/24 -all”





SPF-Operation


DNS




from 192.0.2.123

check if sending address is within SPF-

Data





SPF-Operation


DNS



mail has been received





SPF issues

•SPF is problematic with some mail functions where mail is send indirectly

•mail-forwarding

•mailing lists

•webforms - http://bsdly.blogspot.nl/2016/10/is-spf-simply-too-hard-for-application.html




http://bsdly.blogspot.nl/2016/10/is-spf-simply-too-hard-for-application.html

http://bsdly.blogspot.nl/2016/10/is-spf-simply-too-hard-for-application.html


SPF problem with forwarding


DNS



mailing-listserver

sending mail from [email protected]

on port 25from 192.0.2.123




mailto:[email protected]





DNS



mailing-listserver


on port 25from 203.0.113.23









DNS



mailing-listserver


on port 25from 203.0.113.23

looking up SPF-Recordfor “example.com”









DNS



mailing-listserver


on port 25from 203.0.113.23

example.com IN TXT “v=spf1 ipv4:192.0.2.0/24 -all”









DNS



mailing-listserver


on port 25from 203.0.113.23

check if sending address is within SPF-

Data









DNS



mailing-listserver


on port 25from 203.0.113.23

mail rejected, as the sender IP does not

appear in the SPF data







DKIMDomainKeys Identified Mail





DKIM

• DKIM cryptographically signs selected mail headers and the mail content

• DKIM is used to validate the mail message content but not to secure the transport path

• No upgrade to User Client (Client E-Mail program) needed

• But E-Mail Clients can offer per-User signing, as an option

• DKIM Management can be “outsourced” (ISP, E-Mail Hosting Provider)

• No PKI Infrastructure needed, only depends on DNS





DKIM

• DKIM Website

• http://dkim.org/

• Documents

• RFC 5585 - DomainKeys Identified Mail (DKIM) Service Overviewhttps://tools.ietf.org/html/rfc5585

• RFC 6376 - DomainKeys Identified Mail (DKIM) Signatureshttps://tools.ietf.org/html/rfc6376

• RFC 5863 - DomainKeys Identified Mail (DKIM) Development, Deployment, and Operationshttps://tools.ietf.org/html/rfc5863

• RFC 5617 - DomainKeys Identified Mail (DKIM) Author Domain Signing Practices (ADSP)https://tools.ietf.org/html/rfc5617

• RFC 6377 - DomainKeys Identified Mail (DKIM) and Mailing Listshttps://tools.ietf.org/html/rfc6377




http://dkim.org

http://dkim.org

https://tools.ietf.org/html/rfc5617





DKIM Signature in the Mail Header

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mennogmys.onmicrosoft.com; s=selector1-menandmice-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=Rk04UQbu8aZGogweVSHLqo55rIPXR0OajjGVpZOcEic=; b=cVQyry/E2yMiV9qUZbth0Y51r5OoWoHPr0qYklZYGvc6/[...]

DKIM Version







DKIM Signing

Algorithm







canonicalization algorithm: "relaxed" algorithm that tolerates common

modifications such as whitespace replacement and header field line rewrapping







Domain of the sending party, this is where the public key to verify the signature is located







Subdomain selector: will pre prepended to the domain to fetch the DKIM public key





Fetching the DKIM key

•The DKIM public key can be found inside a TXT record at a domain name build from

• selector

• subdomain “_domainkey”

• base mail domain (d: field)

$ dig selector1-menandmice-com._domainkey.mennogmys.onmicrosoft.com TXT +short"v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDenG16IONFpDPACAhDnCd/N98W277rSbwSoatar767pSYtT+CClFqhmEePynSVGdS0RxIjFZscmVN5RZjnfD+HE1HL4XvUtxnnb1j0PeNfhrDHy7BHFGux6exfL7/splByKu7qhLBP10+SyAjiE4Qc6xWfCQ3MzmECZGW/CzzmOQIDAQAB; n=1024,1450909615,1"







Header-Fields signed by the sending party







Body-Hash: Hash of the message body







Signature over header fields and Body-Hash





DKIM operation


DNS



mailforwarder

mail get signed with “example.com” private

DKIM key





DKIM operation


DNS



mailforwarder


on port 25from 192.0.2.123









DNS




on port 25from 203.0.113.23

mailforwarder









DNS




on port 25from 203.0.113.23

looking up DKIM public keyfor “example.com”

mailforwarder









DNS




on port 25from 203.0.113.23

_domainkeys.example.com IN TXT “v=DKIM1; k=rsa; p=MIG[...]”

mailforwarder









DNS




on port 25from 203.0.113.23

validating DKIM signed headers and

body

mailforwarder









DNS



mailing-listserver

mail has been received





DMARCDomain-based Message Authentication,

Reporting & Conformance





DMARC

•DMARC builds on top of SPF and DKIM

• it allows the owner of an email domain to publish a policy about SPF and DKIM failures

•DMARC can be used to publish a feedback channel to let the domain owner know of spoofed mail from his domain

•the DMARC policy is stored in DNS





DMARC

•example DMARC record

"v=DMARC1;p=reject;pct=100;rua=mailto:[email protected]"

Protocol Version







DMARC



Policy for organizational domain







DMARC



Percentage of messages subjected to filtering







DMARC



Where to send the aggregated mis-use reports






Fighting Abuse with DNS

Technology

Transcript of Fighting Abuse with DNS