Do ‘unspoofable’ email protocols exist?

Question

Been getting a lot more spam lately and this question came to mind. We already use SSL certificates to authenticate websites, can we do something similar for email?

If so, why do I still receive spoofed emails?

Answer 1

There are several protocols actually:

• SPF Sender Policy Framework is used to verify that the e-mail address used to send the message is valid e.g. if the sender had rights to use the given domain. Recipients can verify this by checking the ips of the agent dropping the mail against the allowed ips listed in the domain DNS records.

• DKIM DomainKeys Identified Mail is used to verify that a given message hasn't been tampered in transit. Recipients can verify this using the public key of a given domain along with the signature included in DKIM signed e-mails.

These are actively used in SPAM filtering. You can see it in action by looking at the headers of most e-mails today. You can look for the headers: Authentication-Results, DKIM-Signature, Received-SPF.

Answer 2

If you use PGP or MIME to sign emails with public-key cryptography, this can prevent spoofing of emails. The greatest challenges are key management, human factors, and convincing enough people to sign emails.

Therefore, in practice we use weaker mechanisms, like SPF, DKIM, and DMARC.