How a spoofed e-mail passed the SPF check and landed in my inbox

The Sender Policy Structure can’t assist avoid spam and phishing if you permit billions of IP addresses to send out as your domain

Twenty years earlier, Paul Vixie released an Ask for Discuss Repudiating MAIL FROM that assisted stimulate the web neighborhood to establish a brand-new method of combating spam with the Sender Policy Structure (SPF). The problem then, as now, was that the Easy Mail Transfer Procedure (SMTP), which is utilized to send out e-mail on the web, offers no chance of finding created sender domains.

Nevertheless, when utilizing SPF, domain owners can release domain system (DNS) records that specify the IP addresses licensed to utilize their domain for sending out e-mail. On the getting end, an e-mail server can query the SPF records of the evident sender domain to examine whether the sender’s IP address is licensed to send out e-mail on behalf of that domain.

SMTP e-mail and SPF introduction

Readers knowledgeable about SMTP message sending out systems and how SPF connects with them may choose to avoid this area, although it is mercifully brief.

Picture that Alice at wants to send out an e-mail message to Bob at Without SPF, Alice and Bob’s e-mail servers would take part in an SMTP discussion something like the following, which is streamlined utilizing HELO instead of EHLO, however not in manner ins which substantially change the fundamental constructs:

This is how sending out and getting web (SMTP) e-mail has actually taken place because the early 1980s, however it has– a minimum of by the requirements these days’s web– a significant issue. In the diagram above, Chad at might simply as quickly link to the SMTP server, take part in precisely the very same SMTP discussion and have an e-mail message obviously from Alice at provided to Bob at Even worse still, there would be absolutely nothing showing the deceptiveness to Bob, other than maybe IP addresses taped along with host names in diagnostic message headers (disappointed here), however these are difficult for non-experts to examine and, depending upon your e-mail customer application, are typically hard to even access.

Although not abused in the extremely early days of e-mail spam, as mass spamming ended up being a developed, albeit deservingly abhored, company design, such e-mail forgery methods were commonly embraced to enhance the possibilities of spam messages reading and even acted on.

Back to the theoretical Chad at sending out that message “from” Alice … That would include 2 levels of impersonation (or forgery) where lots of folks now feel that automated, technical checks can or need to be made to discover and obstruct such fabricated e-mail messages. The very first is at the SMTP envelope level and the 2nd at the message header level. SPF offers checks at the SMTP envelope level, and later on anti-forgery and message authentication procedures DKIM and DMARC supply checks at the message header level.

Does SPF work?

According to one research study released in 2022, around 32% of the 1.5 billion domains examined had SPF records. Out of these, 7.7% had void syntax and 1% were utilizing the deprecated PTR record, which points IP addresses to domain. Uptake of SPF has been sluggish and problematic certainly, which might result in another concern: the number of domains have extremely liberal SPF records?

Current research study discovered that 264 companies in Australia alone had exploitable IP addresses in their SPF records therefore may unsuspectingly set the phase for massive spam and phishing projects. While not associated with what that research study discovered, I just recently had my own brush with possibly harmful e-mails that benefited from misconfigured SPF records.

Spoofed e-mail in my inbox

Just recently, I got an e-mail that declared to be from French insurer Vigilance Cr é ole, however had all the trademarks of spam and spoofing:

While I understand that creating the From: address message header of an e-mail is insignificant, my interest was excited when I examined the complete e-mail headers and discovered that the domain in the SMTP envelope MAIL FROM: address had actually passed the SPF check:

So I searched for the SPF record of the domain

That’s a big block of IPv4 addresses! 2 includes 25% of the IPv4 address area, varying from to Over a billion IP addresses are authorized senders for Vigilance Creole’s domain– a spammer’s paradise.

Simply to ensure I wasn’t joking myself, I established an e-mail server in the house, was appointed a random, however qualified, IP address by my web service supplier, and sent myself an e-mail spoofing


To top everything off, I inspected the SPF record of a domain from another spam e-mail in my inbox that was spoofing

Lo and behold, the 0 block permits the whole IPv4 address area, including over 4 billion addresses, to pass the SPF check while impersonating Wild Voyager.

After this experiment, I alerted Vigilance Cr é ole and Wild Voyager about their misconfigured SPF records. Vigilance Cr é ole upgraded their SPF records prior to the publication of this post.

Reflections and lessons discovered

Producing an SPF record for your domain is no death stroke versus spammers’ spoofing efforts. Nevertheless, if firmly set up, making use of SPF can annoy lots of efforts like those getting here in my inbox. Maybe the most substantial obstacle standing in the method of instant, larger usage and more stringent application of SPF is e-mail deliverability. It takes 2 to play the SPF video game due to the fact that both senders and receivers require to balance their e-mail security policies in case e-mails stop working to be provided due to extremely extensive guidelines used by either side.

Nevertheless, thinking about the prospective dangers and damage from spammers spoofing your domain, the following recommendations can be used as suitable:

  • Produce an SPF record for all your HELO/EHLO identities in case any SPF verifiers are following the suggestion in RFC 7208 to examine these
  • It is much better to utilize the all system with the or ~ qualifiers instead of the ? qualifier, as the latter successfully permits anybody to spoof your domain
  • Establish a “drop whatever” guideline ( v= spf1 -all) for each domain and subdomain you own that need to never ever create (internet-routed) e-mail or appear in the domain part of the HELO/EHLO or MAIL FROM: commands
  • As a standard, ensure your SPF records are little, as much as 512 bytes ideally, to avoid them from being calmly neglected by some SPF verifiers
  • Make certain you license just a minimal and relied on set of IP addresses in your SPF records

The extensive usage of SMTP to send out e-mail has actually produced an IT culture concentrated on moving e-mails dependably and effectively, instead of firmly and with personal privacy. Adjusting to a security-focused culture might be a sluggish procedure, however one that need to be carried out in view of making clear dividends versus among the blights of the web– spam.

Read the full article here

Hosted by
News Room

Cybervizer is a blog and podcast site that focuses on the latest technology and cybersecurity topics that are impacting enterprises, both small and large. Join us to explore the most important trends in enterprise technology and cybersecurity today. Get true insights into the tech and trends that will impact you and your organization.

Sign Up for Our Morning Boot Cybersecurity Newsletter

Sponsored Ad

Cybervizer Recommended Book