Episode 476: Leonid Shevtsov on Transactional Email

SPF & DKIM

SPF and DKIM are essential email authentication methods that help verify the legitimacy of email senders. Leonid Shevtsov explains that SPF (Sender Policy Framework) uses DNS records to specify which mail servers are allowed to send emails on behalf of a domain. DKIM (DomainKeys Identified Mail) adds a digital signature to emails, allowing recipients to verify that the email hasn't been altered and is from the claimed domain 1. Despite their importance, these mechanisms are not foolproof, as setups can fluctuate and spammers can exploit them by setting up similar domains with valid SPF and DKIM records 2.

The problem is that the spammers will also set up SPF and DKM, and that's another reason why the mechanisms are not very robust.

--- Leonid Shevtsov

These challenges highlight the need for additional layers of security in email verification.

   

Spoofing

Email spoofing remains a significant challenge despite the use of SPF and DKIM. Robert Blumen and Leonid discuss how spammers can create domains that closely resemble legitimate ones, complete with valid SPF and DKIM records, to deceive users 2. This technique, known as spoofing, allows spammers to send emails that appear to be from trusted sources, complicating the task of email verification.

What you're talking about is the spammer can prove that the email did originate from the domain that it said. It's simply not a good domain, which is a different problem.

--- Robert Blumen

The accessibility of domain registration further exacerbates this issue, as there are no mechanisms to prevent spammers from continuously creating new domains.