DMARC)

Chapter: 14 (Email Authentication).

Threat model

SMTP lets anyone forge the From: header — the mechanical basis of phishing and business email compromise, the #1 initial-access vector in real incidents. The "attacker" is a spoofed sender. SPF/DKIM/DMARC are the defense, but they are widely half-deployed: a domain publishes SPF and believes it's protected, while its DMARC sits at p=none (enforcing nothing) and is still spoofable. This engine evaluates both sides: a domain's published-record posture (is our domain spoofable?) and a receiver's DMARC disposition for an inbound message (should we deliver this?).

What you build (`lab.py`)

parse_dmarc(record) / spf_qualifier(spf) — record parsing.
evaluate_posture(config) — flags spf-missing, spf-permissive (+all/?all), dmarc-missing, dmarc-policy-none, dkim-missing.
is_spoofable(config) — True unless DMARC is published at p=quarantine/p=reject (the whole point: SPF/DKIM without enforcing DMARC don't stop visible-From: spoofing).
evaluate_message(config, msg) — relaxed alignment (same organizational domain), then dmarc_pass = aligned-SPF OR aligned-DKIM, then the receiver disposition (pass / reject / quarantine / none).

Attack cases the tests cover

The core lesson: a domain at p=none (or no DMARC) is spoofable even with valid SPF; only quarantine/reject enforces.
Spoof attempt: an attacker passing SPF for their own envelope domain but forging From: example.com is not aligned → rejected under p=reject, but delivered under p=none.
DKIM survives forwarding: SPF fails through a forwarder, but aligned DKIM still passes DMARC.
Relaxed alignment treats mail.example.com and example.com as aligned.

Run

pip install -r requirements.txt
LAB_MODULE=solution pytest -q
pytest -q

Hardening / extensions

Add the SPF 10-DNS-lookup limit check and macro/redirect/include expansion.
Model ARC (preserving auth across forwarders) and BIMI eligibility.
Parse pct=, sp= (subdomain policy), and adkim/aspf (strict vs relaxed alignment).
Ingest real DMARC rua aggregate reports and compute per-source pass rates.

Interview / resume

"Built an SPF/DKIM/DMARC evaluator that determines whether a domain is From:-spoofable and computes a receiver's DMARC disposition with relaxed alignment — encoding that SPF authenticates the envelope, DKIM survives forwarding, and only aligned DMARC at p=reject stops visible-From: spoofing."

Limitations: alignment approximated by last-two-label org domain; SPF/DKIM pass results are supplied as inputs (no live DNS or signature verification); no PSL-based org-domain lookup.

Security Engineer