trust

Question 1

What are the three main indicators of trust in email?

Answer 1

Envelope (metadata like headers), Content (body and From field), and Context (what we know/believe about the sender or message).

Question 2

Why can trusting the email ‘From’ field be misleading?

Answer 2

The content From: is part of the message and can be spoofed, while the envelope-from is set by sending systems and also not reliably authenticated in SMTP.

Question 3

What are MX records used for?

Answer 3

MX (Mail eXchanger) DNS records indicate the mail server responsible for accepting emails for a domain, ordered by priority.

Question 4

What does an MX lookup show for bath.ac.uk?

Answer 4

It returns bath-ac-uk.mail.protection.outlook.com with priority 10, showing where email for the domain should be routed.

Question 5

What is the issue with SMTP security?

Answer 5

SMTP lacks built-in checks to verify message authenticity. Anyone can send an email pretending to be from any address.

Question 6

What is SPF (Sender Policy Framework)?

Answer 6

A system where domain owners use DNS to list authorized mail servers for sending email from their domain.

Question 7

What is DKIM (DomainKeys Identified Mail)?

Answer 7

It adds a digital signature to outgoing emails, allowing recipients to verify that the message came from the sender’s domain.

Question 8

What did Yahoo require from bulk senders in 2024?

Answer 8

Yahoo began requiring SPF and DKIM for bulk emails to be accepted. Gmail followed with similar requirements.

Question 9

What is DMARC and what does it do?

Answer 9

DMARC lets domain owners publish policies in DNS specifying how to handle unauthenticated messages using SPF/DKIM, and provides feedback reports.

Question 10

How does DMARC determine policy enforcement?

Answer 10

It checks if the From: domain aligns with authenticated SPF or DKIM records. If either aligns, the email passes DMARC.

Question 11

Why is DMARC adoption not universal?

Answer 11

Due to setup complexity, lack of staff/resources, confusing reports, and common use of the default ‘p=none’ policy which does not enforce protection.

Question 12

What is a limitation of DMARC highlighted in 2024?

Answer 12

DMARC only prevents exact domain spoofing, not lookalike domains like xx.com impersonating x.com visually or stylistically.

Question 13

What practical steps can users take to verify email trust?

Answer 13

Check link targets by hovering, verify DMARC records for the sending domain, and evaluate context cues like unexpected requests.