Email security: SPF, DKIM, DMARC and phishing analysis
You set up email authentication for a domain with SPF, DKIM and DMARC, tell forged mail apart by reading headers and safely examine suspicious messages.
Level 201 · 16 lessons · 15 practice labs
Lessons
How email travels
- The journey of an email: client, mail server, MX record
- Reading email headers: the Received chain
- Spoofed senders: envelope address and header address
- Short task: find which server a message really came from
Authentication
- Writing and testing an SPF record
- DKIM signing: key, selector, verification
- DMARC policy: from none to reject
- Reading DMARC aggregate reports
- Encryption in transit: STARTTLS and MTA-STS
- Short task: move the domain safely to a DMARC reject policy
Phishing analysis
- Signs of phishing: urgency, look-alike domains, hidden links
- Examining links safely: redirects and shorteners
- Examining attachments without opening them: macros and archives
- User reporting and bulk removal of a message
- Short task: classify five reported messages
Capstone
- Capstone: secure a domain’s email and investigate a phishing wave
Practice labs
- Find which server a message really came from: Read the Received chain bottom to top and note the address and time of the first external server.
- Compare the display sender with the envelope sender: Find the difference between From, Return-Path and Reply-To in the headers and explain the spoofing pattern.
- Prove spoofing from the authentication results: Interpret SPF, DKIM and DMARC results in the Authentication-Results header and justify that the message is forged.
- Write the right SPF record for the domain: List the sending servers, write the SPF record and try allowed and disallowed addresses with the test tool.
- Find why the DKIM signature is failing: Check the selector and the DNS key, find the setting breaking the signature and show verification passes.
- Find the unauthorised sender in a DMARC aggregate report: Parse the XML report, list the sources failing SPF and DKIM and tell the legitimate one from the fake.
- Fix an SPF record that exceeds the ten-lookup limit: Count the nested includes, show the limit is exceeded and make the record valid by flattening it.
- Block unencrypted delivery with an MTA-STS policy: Publish the policy file and the DNS record and test that delivery without STARTTLS is refused.
- Extract the real address behind the hidden link in this message: Compare the visible text with the href in the HTML body and write down the real target domain.
- Sort five reported messages into phishing or harmless: Assess each message by sender, links and urgency cues and write your verdict in one sentence.
- Safely follow a shortened link’s redirect chain: Follow the redirects from the command line without opening a browser and prove the final page harvests credentials.
- Extract the macro from an attachment without opening it: Inspect the document with oletools and find the auto-running macro and the address it downloads from.
- Catch the invoice sent from a look-alike domain: Spot the character-swapped domain, check its registration date and DNS records and remove the message from every mailbox.
- Read a DMARC aggregate report and count passes and fails: Extract the SPF and DKIM result per source address from a given XML report and state how many messages failed alignment.
- Safely examine an attachment sent in a password-protected archive: Open the archive in the isolated lab, extract without running it the command a shortcut file inside would execute, list the indicators and write your blocking recommendation.
About this course
You set up email authentication for a domain with SPF, DKIM and DMARC, tell forged mail apart by reading headers and safely examine suspicious messages.
What you will learn
- How email travels
- Authentication
- Phishing analysis
- Capstone
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.