Welcome to the mailbox.org user forum!

New Topic

Category Password and Security

Tags domains, SPF, DKIM, spoofing, spam, dmarc

Anti-spoofing for Custom Domains (SPF, DKIM & DMARC)

2153638 shared this question ago

Need Answer

Does mailbox.org offer anti-spoofing options for custom domains? I can find no information about this on the help pages. Other privacy-oriented providers, e.g. protonmail, do offer this (see here: https://protonmail.com/support/knowledge-base/anti-spoofing/).

Mailbox.org should make information about SPF, DKIM and DMARC easy to find.

The same question

Replies (5)

Thomas91 ●

You can always just check the DNS Records yourself.

Short anwer: Yes, mailbox.org uses SPF, DKIM and DMARC.

Long answer: Everyone can send Emails in your name anyway. The mailbox.org SMTP servers do not check if you spoof your from address. See this discussion in the german forum: https://userforum.mailbox.org/topic/mailbox-org-smtp-server-stellt-mails-mit-gefakten-absender-zu

Reply URL

4380628 ●

Gmail antispam system uses DKIM and DMARC. If I send an email with my custom domain to a Gmail user that will may be redireced to spam

Reply URL

Martin ●

I actually have this exact problem. Using Mailbox with custom domain and some of my mail is marked as spam by default on Gmail. The weird thing is that not for all Gmail recipients, but only for some.

Any idea how to resolve this?

URL

Odin ●

I have the same problem, I'm using every method available to increase authenticity of my own domain's email to avoid spam filters, but Mailbox's ip addresses are blacklisted at some anti-spam organizations. I emailed support about this and they responded that they're working on resolving this.

URL

3292338 ●

Yes. Also heard of it. They’re working on their outbound structure to solve those issues.

Hopefully it will work.

URL

Martin ●

Following this article: https://kb.mailbox.org/display/MBOKBEN/Using+e-mail+addresses+of+your+domain (namely DKIM and DMARC) resolved my issue. All mails are now successfully delivered.

URL

2134711 ●

The easy way is to use openssl and generate your private and public keys with this:

openssl genrsa -out private.key 1024
openssl rsa -in private.key -pubout -out public.key

If you want a 2048 bit key change "1024" with "2048".

With a TXT record you have to add:

dkim._domainkey.yourdomain.TLD as a host name (change "dkim" with everything you want e.g. "default, key1" etc).
in the value part v=DKIM1; k=rsa; p=your/generated/key

The SPF it's easy and reported in the support section of mailbox.org site, just add in a TXT record: v=spf1 include:mailbox.org and leave the host empty.

DMARC it's just a string, you don't have to generate nothing, again in a TXT record put:

_dmarc in the host part
v=DMARC1; p=none; rua=mailto:youraddress@yourdomain.TLD

(You can create an alias just for DMARC like reports-dmarc@yourdmain.TLD)

You can find openssl for every GNU/Linux distro and also on Windows I think.

Hope this helps you.

Reply URL

4380628 ●

In order to use DKIM private key should be saved on mail server and public key in TXT record as shown above. It's impossible to setup DKIM by yourself without Mailbox.org support.

URL

2134711 ●

True, I was wrong.

It's not working in our scenario, because we don't have backend access to mailbox.org servers.

So, the previous post was wrong, unless you have your own server or a cloud VPS and running Postfix, Dovecot etc by yourself.

URL

2134711 ●

I'm happy to say that the mailbox.org team added DKIM and DMARC support.

In the knowledge base there are all the info. You can check it here https://kb.mailbox.org/display/MBOKBEN/Using+e-mail+addresses+of+your+domain

There's a detailed explanation of how to add DKIM with your domain.

Hope that is helpful.

Reply URL

4464014 ●

Wonderful! What is `_domainkey` in the DKIM section, though? Is the the subdomain or the content of the TXT record in the SPF part?

URL

2134711 ●

No, it's a standard for DKIM key records.

You have to literally write MBO0001._domainkey on your TXT record, in the subdomain section.

If you check other providers it could be like google1234._domainkey or yahoo1234._domainkey.

So, ._domainkey it's the standard part. The name of the key is the part before.

URL

4464014 ●

Ahh, stupid me! Thanks a lot!

URL

Thom ●

Hi,

BUMPING this topic.

it's look like anyone with a valid mailbox.org account can send mail with domain configured on mailbox.org

E.G. Your account : toto@mailbox.org you can send an email as bidule@adomainname.com if a adomainname.com is configure by another mailbox.org user on mailbox.org,

If you try to spoof an address <something@mailbox.org> It's rejected.

I find this topic looking about DMARC.

I've two mailbox.org account, for different purpose. I tried by configuring Thunderbird to use my first account and spoof random address @mailbox.org and randomadress@mydomain on my 2nd account

I check the result in a test gmail address.

I would like to know what I need to configure to avoid that on mailbox.org, is DMARC the way to go?

For now I've only SPF & DKIM configured.

I read a little bit (https://userforum.mailbox.org/topic/mailbox-org-smtp-server-stellt-mails-mit-gefakten-absender-zu) answer with a translator but I don't get everythings, as I don't read german.

Reply URL

3390379 ●

I just tested this and you are correct. This is extremely troubling.

I have SPF, DKIM, and DMARC setup and I still managed to spoof an email not connected to my account.

URL

Thom ●

I'm a bit confuse , I opened a support ticket as the support didn't reply here ? (after 49 days)

URL

3390379 ●

I have been talking with the support about this and they are saying it’s intended.

I tried to explain the issue further now and I am waiting for another answer.

Meanwhile, I moved 5 users away from Mailbox.org.

URL

Thom ●

Dam! That's terrible, How this can be intended as it's block for the default domain @mailbox.org ?

I hope I'll get a positive feedback from the support, and I hope you are wrong ! but current facts make me think you are not :(

I like the service, I don't really want to move again, when I did this research for DMARC, I was planning to transfer more domains & more accounts to mailbox.org :( :(

URL

Peer Heinlein [mailbox.org] ●

The possibility of using different sender addresses was introduced some time ago due to a a mistake/misconfiguration. Unfortunately, it's not that easy to stop that, since we have many business customers that use us as a mail relay and/or that re using catch-all addresses.

Right now, we're on the way to stop this; we're logging every sender/user mismatch, analyze it and contact users that are sending legal mail without having this account registered in their user data. This takes a lot of time and is difficult.

Hopefully next weeks we'll be able to switch from warn- to reject mode.

This project started in autumn, but making that big/important change in Christmas time isn't a good idea if you have many business customers. It was postponed to spring, but also now, during corona time, many users and companies had much more important stuff to do (also we had), so adding some extra technical issues isn't still good idea. We'll activate this if everybody all over the world calmed down and we had the chance to analyze everything and to minimize the impact of such a change. -That's why "stupid and ease looking changes" take sometimes 9 month even if it is on the roadmap and even if activating that block would take less then 10 seconds...

URL

3661195 ●

Do you have an update here?

URL

David ●

I created this issue long time ago https://userforum-en.mailbox.org/topic/spoofing-protection-again

But, as I checked a minute ago, mailbox doesn't check SPF and DMARC. It's still possible to spoof my custom domain

URL

4571441 ●

I just tried sending as <spoof-test@mailbox.org> (obviously not me, and sorry if it pops up in some logs :-). It went through with DKIM signature and all. If I read Thom's post from 23 months ago correctly, it should have been rejected instead? What is the status here?

URL

4571441 ●

FYI, the reason I tried is because I read about it on HackerNews where it’s discussed as a possible security issue: < https://news.ycombinator.com/item?id=30224906 >

URL

akvadrako ●

I would also be interested in knowing if this changes have been implemented.

URL

mailbox.org Support ●

We have created an internal team in order to approach this issue.

Please bear with us.

URL

tiramisù ●

Is there any update on this issue?

URL

3254103 ●

Hey Support,

When can we expect an adequate level of security from your service?

Your website proudly states: We will do everything to protect you.

Yet, two years have passed, and it is still possible to spoof email from private domains.

Thanks

URL