Neither DKIM nor SPF provide domain owners with a verifiable disposition policy and monitoring. You should deploy SPF, DKIM and DMARC together. At that point either SPF or DKIM may pass but if the passing SPF/DKIM domain(s) don't match the DMARC domain the message isn't authenticated. Unlike SPF, DMARC will load its policy using the From: header, and thus ensure alignment between envelope-From and From: header (for SPF), or DKIM domain and From: header.
DMARC could solve this problem, but it would break a lot of things reliant on forwards. When Yahoo set their DMARC policy to reject, there was quite a stir about it:
https://www.ietf.org/mail-archive/web/ietf/current/msg87153....
In this particular case, it seems the major issue is that spammers got access to 69.64.35.11, which is included in telus.com's SPF record. In the end, this will hurt deliverability for legitimate emails sent with telus.com in the return path, and I suspect telus.com's customer service will have some explaining to do for their customers.
Re:My account is sending spam emails
by massaman_yams on Sunday April 22, 2018 @04:10PM
(#16898287)
ARC is the new standard designed to fix the DMARC edge case with forwarding. It's relatively new, though, so adoption isn't nearly as widespread as SPF, DKIM, or DMARC.
ryan-c comments below that the 'exists:' config at Telus allows any IP to send mail.
Spammers seem to be abusing this hole.
Re:My account is sending spam emails
by thaumaturgy on Sunday April 22, 2018 @03:44AM
(#16895164)
You're right. I was thinking DMARC but wrote DKIM.
it does say DMARC=fail fwiw
Re:My account is sending spam emails
by obituary_latte on Sunday April 22, 2018 @08:23AM
(#16895865)
Gmail's sent folder isn't a sent folder in the traditional sense. It's a label that just filters mails based on the "from" address.
Are you sure about that? I have gotten many spoofed spam emails before but I've never seen them appear in my sent folder before. Furthermore when I search "from:[my email]", I see a different listing than when I look in the sent folder.
Re:My account is sending spam emails
by liquidgecka on Sunday April 22, 2018 @12:01PM
(#16896733)
I have a very short gmail address so I get _loads_ of spam daily. The above is actually correct. Emails from my address, even though they are spoofed will show up in my Sent folder until I mark them as Junk. I just checked with the 3-4 spams I received last night all all where in Sent.
That's a bug.
Does anyone disagree?
It's non-standard, for sure, but it's "by design" and I suppose they can do whatever they want on their own platform. I'll stick with my IMAP4-compliant mail server, though.
I disagree because your sent mail also appears in your inbox and vice versa as part of threads.
It was always like this and I never considered it as bug.
Then that is really stupid. I want an email client, not a gmail client.
Re:My account is sending spam emails
by massaman_yams on Sunday April 22, 2018 @04:26PM
(#16898384)
Re: others forging your domain by using Gmail - this is only true in narrow edge cases like this one (which appears to have been relatively quickly fixed by Gmail).
In practice, the Gmail and G suite UIs provide enforcement mechanisms to ensure you own a domain/address before allowing you to send from it.
Does it potentially open you up to spoofing if another loophole/exploit like this is discovered? Sure. But as risk factors go, depending on who you are, that's probably relatively low on the list.
Adding to this. You can only use Gmail for sending with your own domains when you have 2FA enabled.
Not really. It also works if you also lower your account security setting to low to enable 'Less-secured app' to login.
The only part of this that looks like a Google-specific bug to me is that I'm not sure Gmail should be dropping messages into your Sent folder that did not originate from your authenticated account. If you send a message using some other mail client that logs in to your Gmail account, or an app, or the web app, sure, but if a message just pops into your account with your address as the "from:" header, it shouldn't show up in your Sent label.
The rest of this is just email being as broken as it usually is.
SPF only checks the envelope-from. It doesn't check the other "from:" header. Anybody can easily clone anybody else's SPF records, so any service that allows you to route mail through them and has already cloned Google's SPF records (so that users can send mail through Gmail's servers using their @telus.com address) is vulnerable to this.
If SPF were changed to also check the other from: header, then it would break every single domain that uses Google's mail hosting services but hasn't updated their SPF records. So that's never gonna happen.
This is maybe the biggest reason I wish people would stop using Gmail for any kind of important mail services. The moment you do that, mail from your domain can be spoofed by any other outfit that also uses Gmail, and it will pass SPF, which means it'll cruise right through most spam filters.
DKIM can resolve some of this, but it comes along with a suitcase full of its own nightmares.