diff --git a/index.md b/index.md index f51c554..168c35e 100644 --- a/index.md +++ b/index.md @@ -65,17 +65,19 @@ In this case forwarders modifies the From field in the message header and adds a Sender Sends to Forwarder (sender@gmail.com) - ->From : sender@gmail.com ->To : receiver@forwarder.com ->DKIM-Signature : v=1; a=rsa-sha256; c=relaxed/relaxed;d=gmail.com;b= +``` +From : sender@gmail.com +To : receiver@forwarder.com +DKIM-Signature : v=1; a=rsa-sha256; c=relaxed/relaxed;d=gmail.com;b= +``` Receiver Receives (receiver@yahoo.com) - ->From : "sender@gmail.com" ->To : receiver@forwarder.com ->DKIM-Signature : v=1; a=rsa-sha256; c=relaxed/relaxed;d=gmail.com;b= ->DKIM-Signature : v=1; a=rsa-sha256; c=relaxed/relaxed;d=forwarder.com;b= +``` +From : "sender@gmail.com" +To : receiver@forwarder.com +DKIM-Signature : v=1; a=rsa-sha256; c=relaxed/relaxed;d=gmail.com;b= +DKIM-Signature : v=1; a=rsa-sha256; c=relaxed/relaxed;d=forwarder.com;b= +``` SPF and DKIM both passes with forwarder.com DNS records. The end receiver chooses the domain inside the "< >" i.e forwarder.com to verify the DMARC record, which always pass as SPF and DKIM both passes with the same domain. @@ -94,17 +96,19 @@ Next to Reply , click More Show original. Forwarders that do not modify the `From` field in the message header but adds additional DKIM signatures. Sender Sends to Forwarder (sender@gmail.com) - ->From : sender@gmail.com ->To : receiver@forwarder.com ->DKIM-Signature : v=1; a=rsa-sha256; c=relaxed/relaxed;d=gmail.com;b= +``` +From : sender@gmail.com +To : receiver@forwarder.com +DKIM-Signature : v=1; a=rsa-sha256; c=relaxed/relaxed;d=gmail.com;b= +``` Receiver Receives (receiver@gmail.com) - ->From : sender@gmail.com ->To : receiver@forwarder.com ->DKIM-Signature : v=1; a=rsa-sha256; c=relaxed/relaxed;d=gmail.com;b= ->DKIM-Signature : v=1; a=rsa-sha256; c=relaxed/relaxed;d=forwarder.com;b= +``` +From : sender@gmail.com +To : receiver@forwarder.com +DKIM-Signature : v=1; a=rsa-sha256; c=relaxed/relaxed;d=gmail.com;b= +DKIM-Signature : v=1; a=rsa-sha256; c=relaxed/relaxed;d=forwarder.com;b= +``` Here SPF passes with forwarder.com ip address but DKIM passes with gmail's signature and since DMARC looks at the domain from From field in the message header , the attacker can only spoof email on behalf of any gmail's email address .