今天我收到一封诈骗电子邮件,我决定剖析它。我很快发现它是从 GMail 地址 ( From
, Reply-To
, Return-Path
) 发送的,但邮件本身来自 Yahoo。
- 来自雅虎的 HELO
- 从正向和反向的 IP 映射接收
- 邮件具有 yahoo.com 的有效 DKIM 签名
- Mail 软失败 GMail SPF,因为 Yahoo 拥有的 IP 不是其中的一部分
我已经通过 opendkim-testmsg 传送了邮件,它告诉我邮件很好。
我真的对这一切感到困惑。当然,从技术上讲,任何人都可以使用 DKIM 为自己的域签署任何电子邮件,即使它与邮件中使用的任何域都不匹配。但是雅虎为什么要这样做呢?为什么即使 Return-Path 域和 DKIM 域不匹配,OpenDKIM 也没有表明这封邮件存在钓鱼邮件?
应普遍要求,一些电子邮件标题。请注意,这封电子邮件已通过公司邮件清洗服务 Exchange 和我剥离了很多识别数据。但是,标头部分的 DKIM 签名仍然匹配。我省略了正文,但它也验证了。
Received-SPF: softfail (MYMX: transitioning domain of gmail.com does not designate 87.248.110.97 as permitted sender) client-ip=87.248.110.97; envelope-from=helenslomonn@gmail.com; helo=sonic302-34.consmr.mail.ir2.yahoo.com;
Received: from sonic302-34.consmr.mail.ir2.yahoo.com ([87.248.110.97])
by MYMX with esmtps (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128)
(envelope-from <helenslomonn@gmail.com>)
for MYNAME@MYDOMAIN; Wed, 28 Feb 2018 05:03:02 -0800
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1519822976; bh=35/Syp7oOntp7GfGR2tdK316KBE4uAxZC5lOM//DYjg=; h=Date:From:Reply-To:Subject:References:From:Subject; b=KvnuAmNY1sujXiLsVnNqOJzF3MFxu/jY93zu5QKtbWRy9nMOhomUrZ+398oRwLC0P0RAkCbOj5a2x5JZtrZG4/71RKmHD/ftzOJI2goX2A4KaWrsczH4RsR/kfvpmz0jNRF4nxZONN4a5NKLavt6WPG7yWokVrGh2n/zUZPiFFv8kZL0uNPdIyCC94OiBh0c6GlSRpmTe0GbTQmbDgXZ+8nf7O5kiWpALbpSBHJ22QmdFhLLQWS18xZhl/AwprHFV+txsWtat02ldjYUmoGKhXNmTcWHDLPw7n5uyKXwsaOuX1uXSLzaWUgpnrD/v/FonebJoo1qkcnZoziov6TJmw==
X-YMail-OSG: dOZOfQ0VM1lyzg2OUT1yoveGRURYm6FHV_CU8qWTCRbr8jkKD_gBSwprVT5nSNr
oxL32bI8ge8m_n_BDyDXFKnfZTDdFMGUPxFQt8bl2TLbWIC72.HGgEg6S8trxoSkeYLsPM8tUIhL
XPCdlp3sNlz4quLJyyJznVo55S3vYeLt5fYSOqw2kJtOvf3l.puohOlVCc5WBZO1lp82MLbBi0rq
0tCsbA3xDFW8_3JsxoJGinZ8fn0BBoqUfkfFdGv7UyoM94wlv4_GWYAQwIzicSQsC5od.fBm1lM_
zSZlsV9hfeDUkwDyQiAmFq5rCUJ.3N7Lu9IKZTwnKjWvRFNudXOkEEJwW7Dg0eRNCBx.N2c.52Bi
dfwYepO_0jqL.vF19srHCbj6PrUQjFYiIzaauD.m9IdfE692oG6o9B.w20VkMLmTcxjBKg7NC1pk
6mWavSA7yHndoNrMfcB.liBw3XSLggRvPH60M
Received: from sonic.gate.mail.ne1.yahoo.com by sonic302.consmr.mail.ir2.yahoo.com with HTTP; Wed, 28 Feb 2018 13:02:56 +0000
Date: Wed, 28 Feb 2018 13:02:52 +0000 (UTC)
From: hs <helenslomonn@gmail.com>
Reply-To: hs <helensslomonn@gmail.com>
Message-ID: <909434698.11100734.1519822972957@mail.yahoo.com>
Subject: MRS.HELEN SOLOMON FUNDS TRANSFER ASSISTANCE.
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
References: <909434698.11100734.1519822972957.ref@mail.yahoo.com>
To: Undisclosed recipients:;
Return-Path: helenslomonn@gmail.com
MIME-Version: 1.0