HackBlue

Tools · Workbench

Email security

Tutorials on SPF, DKIM, DMARC, reading email headers, MTA-STS, BIMI, and how to investigate a suspicious message.

  • 18 lessons
  • 2.5 h of reading
  • 3 topics
Start with lesson 1All workbenches

Email was designed without sender authentication, so the protections were added later as DNS records and headers. These tutorials explain each record, how to read the results a receiving server stamps on a message, and how to roll out enforcement without losing legitimate mail.

Use your own domain or a test domain. Header analysis examples use sample messages.

Sender authentication

7 lessons

  1. 01SPF in depth: mechanisms, qualifiers, and the ten-lookup limitRead and write SPF records mechanism by mechanism, understand how receivers evaluate them, and avoid the permerror caused by exceeding ten DNS lookups.9 min
  2. 02DKIM: selectors, public keys, and verifying a signature yourselfUnderstand how DKIM signs headers and body, find a sender’s public key through its selector, read the tags in a DKIM-Signature header, and plan key rotation.9 min
  3. 03DMARC alignment: why SPF or DKIM passing is not enoughLearn how DMARC ties SPF and DKIM results to the visible From domain, the difference between relaxed and strict alignment, and how third-party senders commonly fail it.8 min
  4. 04Rolling out DMARC from p=none to p=reject without breaking mailPlan a staged DMARC deployment: monitor with p=none, fix legitimate senders, move through quarantine with pct, cover subdomains with sp, and reach reject safely.9 min
  5. 05Reading DMARC aggregate reports to find every sender using your domainParse DMARC rua XML reports, group results by source IP and alignment, identify legitimate senders that need fixing, and spot spoofing attempts.9 min
  6. 06Forwarding, mailing lists, and ARC: why legitimate mail sometimes fails DMARCSee how forwarding breaks SPF, how list footers and subject tags break DKIM, and how Authenticated Received Chain lets trusted intermediaries vouch for the original results.8 min
  7. 07BIMI: showing a verified logo, and what it requires firstUnderstand Brand Indicators for Message Identification, its dependency on DMARC enforcement, the SVG Tiny PS logo format, and the role of verified mark certificates.7 min

Transport security

2 lessons

  1. 01MTA-STS: requiring TLS for mail delivered to your domainPublish an MTA-STS DNS record and HTTPS policy so sending servers refuse to deliver over downgraded or unauthenticated connections, starting in testing mode.9 min
  2. 02SMTP TLS Reporting: learning when senders cannot connect securelyPublish a TLS-RPT record, read the JSON reports senders return, and use them to catch certificate and MTA-STS problems before enforcement blocks mail.7 min

Investigation

9 lessons

  1. 01Reading raw email headers: tracing the Received chain hop by hopOpen the raw source of a message, read Received headers from bottom to top, identify the true originating server, and know which headers a sender can forge.9 min
  2. 02Interpreting Authentication-Results: spf, dkim, dmarc, and compauthRead the Authentication-Results header your provider adds, understand each result and the identifiers it refers to, and avoid trusting copies of the header added by others.8 min
  3. 03Triage workflow for a reported suspicious emailWork a user-reported message from intake to verdict: preserve it, analyze headers, links, and attachments safely, scope who else received it, and remediate across mailboxes.10 min
  4. 04Handling URLs from suspicious email: extraction, defanging, and reputation checksExtract every link including those behind HTML text, defang them for safe sharing, unwrap redirectors and safe-link rewrites, and check reputation without visiting the site.8 min
  5. 05Static triage of email attachments: hashes, file types, and macro inspectionTriage attachments safely by hashing, identifying true file types, inspecting Office documents for macros with oletools, and escalating to a sandbox only when needed.9 min
  6. 06Monitoring lookalike domains of your own brand with dnstwistGenerate typo, homoglyph, and TLD variants of your domain, find which are registered and have mail records, and set up ongoing monitoring and takedown requests.8 min
  7. 07Auditing mailbox rules and external forwarding after a suspected account compromiseFind inbox rules and forwarding settings commonly abused after account takeover, query them in Microsoft 365 and Google Workspace, and block automatic external forwarding by policy.9 min
  8. 08Payment-change verification controls that stop invoice fraudDesign process controls for bank detail changes and urgent payment requests: out-of-band callbacks, dual approval, external sender tags, and how to respond when a fraudulent payment is sent.8 min
  9. 09Building a user-reported phishing pipeline that people keep usingSet up a report button and abuse mailbox, automate enrichment and deduplication, measure time to verdict, and close the loop with reporters.8 min