电子邮件身份验证：SPF、DKIM 与 DMARC

电子邮件欺骗问题

发件人策略框架（SPF）

# SPF DNS TXT record for example.com
# Authorize Google Workspace + SendGrid + company IP
example.com.  TXT  'v=spf1 include:_spf.google.com include:sendgrid.net ip4:203.0.113.10 -all'

# Mechanism meanings:
# include:  authorize another domain's SPF record
# ip4:      authorize specific IPv4 address/range
# ip6:      authorize specific IPv6 address
# -all      FAIL (reject) mail from non-listed sources
# ~all      SOFTFAIL (accept but mark as spam)
# ?all      NEUTRAL (no policy stated)

SPF 的局限性

DomainKeys Identified Mail（DKIM）

# DKIM DNS TXT record (selector: 'google')
google._domainkey.example.com.  TXT \
  'v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GN...'

# DKIM-Signature header in email:
DKIM-Signature: v=1; a=rsa-sha256; d=example.com;
  s=google; h=from:to:subject:date;
  bh=<body_hash>; b=<signature>

# Verification:
# 1. Extract 'b=' (signature)
# 2. Fetch public key at google._domainkey.example.com
# 3. Verify signature over 'h=' headers + body hash

DKIM 选择器与密钥轮换

DMARC：基于 Domain 的邮件身份验证

# DMARC DNS TXT record
_dmarc.example.com.  TXT \
  'v=DMARC1; p=reject; sp=reject; \
   pct=100; \
   rua=mailto:dmarc-reports@example.com; \
   ruf=mailto:forensic@example.com; \
   adkim=s; aspf=s'

# p=reject   : reject failing messages (strongest)
# pct=100    : apply to 100% of messages
# adkim=s    : strict DKIM alignment
# aspf=s     : strict SPF alignment
# rua=       : aggregate report destination

DMARC 对齐

# DMARC alignment example
Envelope From: attacker@legit.com  <- SPF may PASS for legit.com
From header  : spoofed@example.com <- VISIBLE to user

# Without DMARC: SPF passes (envelope from legit.com)
# User sees spoofed@example.com and trusts it

# With DMARC on example.com:
# SPF alignment check: legit.com != example.com -> FAIL
# DKIM: attacker has no private key for example.com -> FAIL
# DMARC result: FAIL -> message rejected per policy

分阶段部署 DMARC

# DMARC rollout stages
Stage 1: p=none; pct=100  (monitoring only)
Stage 2: p=quarantine; pct=10  (10% to spam)
Stage 3: p=quarantine; pct=100 (all to spam)
Stage 4: p=reject; pct=100     (block at MTA)

# Monitor RUA reports between each stage
# Look for legitimate sources failing alignment
# Common gotchas:
# - Marketing platforms sending as your domain
# - IT ticketing systems
# - Automated notification services
# - Third-party CRM tools

BIMI：消息识别品牌标志

SPF、DKIM 与 DMARC 协同工作

# Email authentication check order
1. Receiving MTA receives message
2. SPF check: is sending IP authorized? (envelope From)
3. DKIM check: is signature valid? (using public key DNS)
4. DMARC check:
   a. Did SPF pass with alignment? OR
   b. Did DKIM pass with alignment?
   -> If YES: PASS (deliver normally)
   -> If NO: apply DMARC policy (none/quarantine/reject)
5. Reporting: send aggregate data to rua= address

外部电子邮件横幅

# Example external email banner (SEG inserts this)
# --- EXTERNAL EMAIL ---
# This message was sent from outside the organization.
# Do not click links or open attachments unless
# you expected this email and trust the sender.
# Report suspicious email: phishing@company.com
# ----------------------

# Proofpoint SEG: add disclaimer via content filter
# Match: Header 'X-MS-Exchange-Organization-SCL' absent
# Action: Prepend HTML banner to message body

快速检查

课程回顾