Publish SPF, DKIM and DMARC and check they agree

short · 45 min · Objective 4.5

Task

Publish the three records for a domain you control in your own lab DNS, then evaluate messages against them and find the alignment failure that SPF alone cannot see.

Steps

  1. In your local resolver, create a zone for lab.example and publish an SPF TXT record naming your Linux VM's address as the only permitted sender.
  2. Generate a DKIM key pair and publish the public key as a TXT record at a selector you choose.
  3. Publish a DMARC record at _dmarc.lab.example with p=none and an rua address — the position every deployment starts from.
  4. Write /tmp/evaluate.py: given a message file and the zone, it checks whether the sending address is permitted by SPF, whether the DKIM signature verifies, and — the part that matters — whether either passing domain ALIGNS with the From: header domain.
  5. Evaluate three messages: one fully aligned, one where SPF passes for a different domain than the From: header, and one with a broken DKIM signature.
  6. Record in /tmp/email-auth.md which of the three would be delivered under p=none, p=quarantine and p=reject, and why the second message is the one SPF alone cannot catch.

Verify

dig +short TXT lab.example @127.0.0.1 | grep -c "v=spf1"
dig +short TXT _dmarc.lab.example @127.0.0.1 | grep -c "v=DMARC1"
python3 /tmp/evaluate.py /tmp/msg-aligned.eml | grep -ci "dmarc=pass"
python3 /tmp/evaluate.py /tmp/msg-misaligned.eml | grep -ci "dmarc=fail"

All four must be non-zero. The fourth is the one that teaches: the misaligned message passes SPF — genuinely, for the attacker's own domain — and fails DMARC, because DMARC is the only one of the three that requires the passing domain to match what the recipient actually sees in the From: line.

Notes

This estate has a local constraint worth knowing if you publish these for real: TXT records here are capped at 255 characters, which forces a 1024-bit DKIM key rather than 2048. That is a real limitation of the DNS provider rather than a choice, and it is the kind of detail that only appears when you try it.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.