News for hackers. Stuff that matters.

A comment on See how DMARC, SPF, and DKIM work interactively. Parent comment

Re:See how DMARC, SPF, and DKIM work interactively by kro on Monday January 10, 2022 @01:13AM (#29871249)
Where does it say that? As per rfc7489 4.2:

A message satisfies the DMARC checks if at least one of the supported authentication mechanisms:

   1.  produces a "pass" result
Personally I did not test yet what a DMARC result 1 fully failing check produces. I can say however that only 1 successful identifier-alignment criteria (and the other credential being valid but not aligned) is enough for an overall pass.

Of course the receiving mailserver is free to enforce a strict DKIM&SPF requirement aside the DMARC check/spec. If your question is why that would be necessary, I'd love to hear the reason aswell

[ Parent | on HN ]
Re:See how DMARC, SPF, and DKIM work interactively by pracer on Monday January 10, 2022 @04:45AM (#29872451)
As mentioned above, I think it is due to the fact that SPF may be too broad, as in softfail SPF (defined here https://datatracker.ietf.org/doc/html/rfc7208#section-2.6.5).

Based on the RFC, for the rest of possible SPF configurations (more strict), SPF record would be enough. But I am guessing based on the RFC document and my experience.

[ Parent | on HN ]