Why am I able to send from an unrelated domain? | Community
Skip to main content
Broderick_Klem1
Broderick_Klem1
Level 3
February 14, 2019
Question

Why am I able to send from an unrelated domain?

  • February 14, 2019
  • 1 reply
  • 3170 views

We're in the process of cleaning up our SPF record (too many entries) and it let me down the rabbit hole that is SPF/DKIM. I felt like I understood it until I tried sending some test emails out of curiosity. Our SPF is currently on our main domain (and I think our branded domain as well). Out of curiosity, I sent my personal email an email from one of our competitors and it showed up and wasn't marked as spam! (though it did have a "via mktdns.com" after the sender email). Why am I able to do that without the message being marked as spam? Shouldn't gmail (my personal email) see that our Marketo instance isn't authorized to send from that domain and the email be marked as spam?

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.

1 reply

SanfordWhiteman
SanfordWhiteman
Level 10
February 14, 2019

SPF is only checked for the envelope sender domain. On regular Marketo instances this is {something}.marketo.com. On your instance, if you're paying for branded envelope sender, it's your special envelope subdomain. Changing the From: header doesn't change the SMTP envelope.

Broderick_Klem1
Broderick_Klem1Author
Level 3
February 19, 2019

So shouldn't the fact that we obviously don't have DKIM setup for our competitors domain prevent us from sending emails as them? I'm still confused why those emails didn't go to spam when Gmail looked at the from address and compared it to our envelope.

SanfordWhiteman
SanfordWhiteman
Level 10
February 19, 2019

So shouldn't the fact that we obviously don't have DKIM setup for our competitors domain prevent us from sending emails as them?

Not at all. DKIM is a non-repudiation mechanism: a signed message with a valid signature is guaranteed to have been authorized (at some level) by the domain owner -- or, more precisely, the domain owner cannot claim it was forged by outside forces.

A signed message with a broken/invalid signature can be assumed to be malicious, and thus should be rejected.

An unsigned message is simply repudiatable, like any standard message. That doesn't get it blocked except by servers with ultra-strict DMARC enforcement (and if the domain has a DMARC policy to match).

Terms & ConditionsAccessibility statement

Loading footer...