[FIXED] How can you verify that an email was sent from the proper domain and that the contents of the email haven't been modified?

Issue

I'm examining my email headers (sent from Gmail) and am wondering which ones are best to verify that an email was sent from the proper domain and that the contents of the email haven't been modified?

Solution

I'll use an example message I received from Stack Overflow to illustrate what you can do to verify a message manually.

SPF isn't a great deal of use after delivery as it's a relatively minor (but important) step of verifying the origin of messages, but it's good to know that it was good at the time, and the headers tell you that. The parts of message content related to delivery are the Return-path header added by the receiver, along with the last Received header that shows where it was received from:

Return-Path: <bounces+3553988-07ba-marcus=example.com@em.stackoverflow.email>
Received: from o1.em.stackoverflow.email (o1.em.stackoverflow.email [167.89.81.234])
    (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
    (No client certificate requested)

Looking up this em.stackoverflow.email domain as a TXT record in DNS gives us:

# dig txt +short em.stackoverflow.email
u3553988.wl239.sendgrid.net.
"v=spf1 ip4:167.89.81.234 ip4:167.89.85.72 ip4:168.245.32.199 -all"

and we can see that the 167.89.81.234 IP that appears in the Received header is explicitly listed in the record, so SPF checks out. Other domains might have more complex needs to verify the SPF, e.g. requiring additional DNS lookups for include mechanisms. Significantly, SPF does not even look at the address used in the From header; it can be entirely unrelated to the return path domain.

DKIM is where the real action is. You can use the information in a DKIM-signature header to verify that a message has not been tampered with. For example:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; 
    d=stackoverflow.email; 
    h=from:subject:to:reply-to:mime-version:content-type; s=s1; 
    bh=IgKJJZNcUhfjH6LDr4XaWr3pBwq6wwxwyrGmf+k3DVo=; b=rR4J7VyvF3i0N
    20IX9bx0LGTKpSKj7XoHJurhBjcZLLTn/hXuZ8OMehfgMNFeXaMljlOz4tfoFwit
    aJ8UtK1oMVCPiv9200hpQViCh/5VsyYbs6k3YN6R3cFxMbrb7nflodXX+4Rp4xBu
    T+CloNFEDICtWJT4bVSrs/NRAUlJWY=

Look at the From header and check that it matches the domain shown in the d field of the DKIM signature, which it does:

From: Stack Exchange <do-not-reply@stackoverflow.email>

The DKIM signature has 2 signature parts: b is a signature for the message body, and bh is a signature for the message headers. The interaction of these is quite tricky. To generate a signature, first of all you calculate the body signature, then you calculate the header signature which includes the body signature, along with the canonicalised message headers listed in the h element except for the actual value of the bh element, because that would present a chicken & egg problem. The bh signature only includes the headers listed because mail servers may add other headers that should not be included, or that are not known at the time of sending, such as Return-path and Received. Stack overflow's signature is unusual in that it does not include the Date header, so the date on a message can be altered without breaking the DKIM signature.

To verify a signature you need the public key it was signed with, which you can get from DNS using the s field, which provides the selector, in this case s1:

# dig txt +short s1._domainkey.stackoverflow.email
s1.domainkey.u3553988.wl239.sendgrid.net.
"k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCyJRzkL/aRo1F1+ChY+Crt2TARqqo7tGATw3fMfzW8MXFWaoW1rSvZsq4k1EIf2iW7gO/QZjU1Td7h1aZpS63/CmpKymmqNbHnnbTxZGvZziKPcL/R2PVL0g88MFcpAuSjIsGysYTeow0mnXQ5W03z5mtWqm5nxNM40A/TIlOegwIDAQAB"

One issue with this signature is that it only uses a 1024-bit key; gmail ignores DKIM signatures with less than 2048 bits, so I would not be surprised if SO has deliverability issues with gmail.

Actually verifying a DKIM signature is a complicated process, especially if it uses the relaxed canonicalisation algorithms (which make the signatures more likely to survive the email journey). I wrote a PHP DKIM validator that you could use to verify your own messages.

The final layer is DMARC which ties SPF, DKIM, and the From address header together. Looking back at the Return-path, we can see that the return path domain is a subdomain of the domain used in the From header. This means that it qualifies for "relaxed" rather than "strict" alignment. We can see SO's DMARC record:

# dig txt +short _dmarc.stackoverflow.email
"v=DMARC1;p=reject;sp=reject;pct=100;rua=mailto:dmarc-aggregates@stackoverflow.com;ruf=mailto:dmarc-forensics@stackoverflow.com;fo=1"

This tells us that SO wants receivers to enforce SPF and DKIM checks strictly, and to reject any messages that do not check out, and they have set up addresses to receive summary and forensic reports of any messages that fail.

There's lots more detail but this isn't really the place for it. There's a good article on it all here.

Answered By - Synchro

Answer Checked By - David Goodson (PHPFixing Volunteer)