Home on Technical Notes

Architecture and concepts - 1/9

Mon, 01 Jan 0001 00:00:00 +0000

Introduction#

Purpose and audience#

There are three types of users of the email system:

Mailbox users
Domain administrators
Email infrastructure maintainers

This series of articles is aimed at domain administrators who need to configure email mailboxes in a way that prevents identity spoofing.

When proprietary software abandons us

Mon, 01 Jan 0001 00:00:00 +0000

Why this article#

I spent more than twenty years developing and architecting software. Over those years, I watched the same scenario repeat itself: a technology company decides, alone and unilaterally, to abandon a technology, break compatibility, change a price or a licence — and users, freelancers, associations, whole companies find themselves left high and dry. Not by accident, but because the very model of proprietary software allows it.

Standard email addresses - 2/9

Mon, 01 Jan 0001 00:00:00 +0000

The anti-spoofing protocols we will cover in the following articles are the walls of your fortress, and the standard email addresses are the guard posts. If you build the walls (SPF/DKIM) but there is no one in the guard posts (postmaster/abuse) to hear the alarms, your security will eventually be bypassed or degraded without your knowing it. Let’s start by configuring the standard email addresses.

The flip side of permissive licences — FreeBSD, and freedom for whom?

Mon, 01 Jan 0001 00:00:00 +0000

In the founding article of this series, I recounted how proprietary software ends up abandoning its users. The answer I champion is free software. But “free” is not a single block: there are two great families of licences, with opposing philosophies.

Copyleft licences: the freedom that can't be taken back

Mon, 01 Jan 0001 00:00:00 +0000

The first instalment of this series explored permissive licences (BSD, MIT, Apache) through FreeBSD: they leave everyone free to do what they like with the code, including closing it back up. Here is their counterpart: copyleft licences.

FCrDNS and cross-validation - 3/9

Mon, 01 Jan 0001 00:00:00 +0000

How it works#

This technique emerged as a best practice in the 1990s.

The security principle: The robustness of this technique relies on the need to control both the IP infrastructure (the hosting side) and the DNS zone (the domain side). An attacker who holds only one of the two accesses will not be able to pass the test.

SPF (Sender Policy Framework) - 4/9

Mon, 01 Jan 0001 00:00:00 +0000

How it works#

Standardized in 2006 (RFC 4408), updated in 2014 (RFC 7208).

SPF acts as a trust directory. The owner of domain a.com publishes in its DNS (a TXT record) the list of IPs authorized to send email on its behalf.
When an email arrives, the receiving server checks the sending IP against this list. Note: SPF verifies the domain announced in the envelope’s MAIL FROM command — the very one that will be copied into the Return-Path upon receipt —, and not the From (the header visible to the user).

Why the Linux kernel stayed on GPLv2: Torvalds versus GPLv3

Mon, 01 Jan 0001 00:00:00 +0000

In the previous article on copyleft licences, one detail was worth pausing on properly: GPLv3 (2007) added an anti-tivoization clause, and the Linux kernel never moved to GPLv3. The most visible opponent of that version: Linus Torvalds, the creator of Linux.

DKIM (DomainKeys Identified Mail) - 5/9

Mon, 01 Jan 0001 00:00:00 +0000

How it works: the police evidence seal#

Standardized in 2007 (RFC 4871), updated in 2011 (RFC 6376).

Whereas SPF protects the envelope (the sending server), DKIM (DomainKeys Identified Mail) protects the message itself. It is the digital equivalent of a police evidence seal:

DMARC (Domain-based Message Authentication) - 6/9

Mon, 01 Jan 0001 00:00:00 +0000

The Conductor#

Published in 2015 (RFC 7489).

So far, we have seen that:

SPF validates the IP but verifies the Return-Path, not the From.
DKIM validates the content and verifies the signature domain (d=). It does not verify the From.

DMARC (Domain-based Message Authentication, Reporting, and Conformance) does not offer a new technical authentication method, but a policy layer that builds on SPF and DKIM to solve the alignment problem.

BIMI and an analysis of its limits - 7/9

Mon, 01 Jan 0001 00:00:00 +0000

In the email security ecosystem, BIMI (Brand Indicators for Message Identification) is often presented as the logical next step after achieving DMARC compliance. The goal is to allow a certified logo to be displayed in email clients in order to reinforce visual trust.

However, an in-depth technical analysis reveals that this protocol is more complex than it appears. Unlike SPF or DKIM, which are purely declarative, BIMI generally relies on a trusted third party through a digital certificate called a VMC (Verified Mark Certificate). While this mechanism works in integrated environments (such as the Google or Yahoo webmails), it runs into major structural obstacles as soon as it is confronted with the open, standardized architecture of email.

Parked Domain Locking - 8/9

Mon, 01 Jan 0001 00:00:00 +0000

A domain that sends no email at all must still configure SPF, DKIM and DMARC in order to declare: “This domain never sends email. If you receive one, discard it immediately.” This is essential to protect against spoofing: attackers could use “dormant” domains or variations of your domain (typosquatting) to send phishing, since no one is watching them.

Here is the DNS configuration to apply:

Type	Host / Name	Value	Role
TXT	@	v=spf1 -all	SPF (Declares that no one is authorized to send email on behalf of the domain)
TXT	_dmarc	v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s;	DMARC (Asks the recipient to reject any email that claims to come from the domain)
TXT	*._domainkey	v=DKIM1; p=	DKIM (Invalidates all keys)
MX	@	. (Priority 0)	MX (this domain does not receive email RFC 7505 (Null MX))

Summary and conclusion - 9/9

Mon, 01 Jan 0001 00:00:00 +0000

Summary and conclusion#

Mechanism	Date / RFC	Metaphor	Role	Key limits
FCrDNS	~1990s	The technical inspection of the truck that carries the envelopes.	Validates that the infrastructure owner (the one who controls the IP / L3) and the identity owner (the one who controls the Domain / L7) agree. Verifies that the sender’s `PTR` is not generic.	Does not prove that the source IP is legitimate to send an email on behalf of the sending domain, nor that the message has not been forged.
SPF	2006 (RFC 4408) 2014 (RFC 7208)	Validates that the truck is authorized to carry the sender’s mail.	Authorizes a list of IPs to send email on behalf of the domain indicated in the `Return-Path`.	Vulnerable to redirection. No alignment with the visible field (`From`).
DKIM	2007 (RFC 4871) 2011 (RFC 6376)	Digital wax seal Police evidence seal	Guarantees the integrity and authenticity of the message by adding a cryptographic signature to it. (`d=` in the DKIM header).	No mandatory alignment with `From`. Does not guarantee confidentiality (the email remains readable).
DMARC	2015 (RFC 7489)	The Butler (head of the protocol). Verifies that the letter’s header is aligned either with the address on the back of the envelope (SPF) or with the digital wax seal (DKIM signature)	Verifies the alignment of the domain verified by SPF or DKIM with the visible domain (`From`). Defines the policy for handling failures (`none`, `quarantine`, `reject`). Enables reporting (RUA/RUF)	Works only if SPF/DKIM are implemented and the policy is active.

Securing email is not the business of a single protocol, but rests on a defense-in-depth strategy. Combining the FCrDNS, SPF, DKIM and DMARC protocols makes it possible to create a robust chain of trust, making technical identity spoofing almost impossible, provided the chain is not broken.

Quiz: Polymorphism

Mon, 01 Jan 0001 00:00:00 +0000

📝 Test your knowledge#

Have you really grasped the internal mechanics of polymorphism and Vtables? This is the moment to check whether you have mastered the difference between static and dynamic binding. Click “See the answer” to confirm.

Question 1#

In the code Animal a = new Dog();, if you call a.SayHello() (a non-virtual method), which version of the method is executed?

A) The one from the Dog class because the object is a Dog.
B) The one from the Animal class because the variable is of type Animal.
C) None, it causes a compilation error.
D) The Dog’s one, only if it uses the override keyword.

🔻 See the answer

Answer B: The one from the `Animal` class.
Since the method is not virtual, the compiler uses static binding. It relies solely on the type of the variable (`Animal`) and sets in stone the call to `Animal.SayHello` as early as compile time.

Question 2#

Which C# keyword enables dynamic binding (a call via the Vtable) in the base class?

Quiz: Stack and Heap

Mon, 01 Jan 0001 00:00:00 +0000

📝 Test your knowledge#

Have you really grasped the nuance? This is the moment of truth. Click “See the answer” to check your understanding.

Question 1#

What is the main characteristic of the Stack compared to the Heap in terms of performance?

A) It is slower but can store more data.
B) It is much faster to access and allocate.
C) There is no performance difference.
D) It is optimized for large objects only.

🔻 See the answer

Answer B: It is much faster.
Allocation on the Stack is immediate (moving a CPU pointer), whereas the Heap requires finding a free space and managing it later via the Garbage Collector.

Question 2#

In C#, where is the value of a local variable of type int stored (for example int age = 25;)?