Very cool.
> For DMARC to pass, DKIM and/or SPF checks need to pass and the domains must be in alignment.
AFAIK this is incorrect.
It is not "and/or" but rather "or" - only DKIM or SPF needs to pass. There is no method to require both.
> For DMARC to pass, DKIM and/or SPF checks need to pass and the domains must be in alignment.
AFAIK this is incorrect.
It is not "and/or" but rather "or" - only DKIM or SPF needs to pass. There is no method to require both.
The basic problem being that mailchannel did not require authentication - cloudflare workers could just hit an API endpoint on mailchannel to send email. Mailchannel required you to add an include: record to your SPF policy. This allowed anyone to impersonate anyone else due to mailchannel being a valid sender for all domains.
Only ~400 domains of the 2M hosted had DKIM set up but even if they did the passing SPF caused DMARC to pass.
[1] https://blog.cloudflare.com/sending-email-from-workers-with-...
Domain Lockdown: We added this to our Cloudflare Workers integration. It mandates a DNS TXT record to authorize a Worker to send emails from a specific domain. You can't forge the CF-Worker header, so impersonation is off the table.
Pre-Lockdown Vulnerability: Yes, we were more exposed before. Thanks to the researchers who pointed it out, we've patched this up with Domain Lockdown.
SMTP Relay & Web Hosting: Domain Lockdown isn’t mandatory yet in the rest of our service for the web hosting industry. But we’re developing updates for our cPanel WHM plugin and other integrations to make this scalable for millions of domains. Note that our service has to work for applications like public mailing lists where locking the sender domain down breaks stuff.
Scale & Standardization: We service a broad range of configurations. Rolling out universal changes takes time. We're also working with industry groups like M3AAWG to push for improvements to DMARC and other standards to help everyone be more secure.
Tech docs for the curious: https://support.mailchannels.com/hc/en-us/articles/456589835...
Appreciate all the questions and criticism here. reply
I didn't mean anything negative towards MailChannels - I know this is a weak link in the chain for many people. I did know it was resolved and I should have mentioned that but I couldn't figure out the search query to find that post.
The point I was making is that "DMARC passes if DKIM _and_ SPF passes" and "DMARC passes if DKIM _or_ SPF passes" are both true - you can't specify "DMARC passes if, and only if, DKIM _and_ SPF passes"
The english language being ambigious or not making sense is not a new issue. All i know, is i almost always see "and/or" used to mean inclusive or.
Also the dictionary seems to agree it means inclusive or: https://en.m.wiktionary.org/wiki/and/or
I was only trying to point out that "and/or" is ambiguous (which we agree, and Wikipedia even agrees - 2 paragraphs for a defintion, 5 paragraphs of criticism) and one of those ambiguities is thinking it means logical AND - which is something DMARC does not do.
Using just "or" would have been fine and conveyed the same meaning as it does now.
If the "From:"/"Reply-To:" fields contains only the email address with the IP address literal, you get your "SPF" and it gets a much better score in order to avoid grey listing for the first transaction. And if there are no URLs in the content, even better.
But that is common sense.