Windows 10 reached EOS (end of support) on October 14, 2025. If you are on Windows 10, see this article.

Avatar for Username

Αναζήτηση στην υποστήριξη

Προσοχή στις απάτες! Δεν θα σας ζητήσουμε ποτέ να καλέσετε ή να στείλετε μήνυμα σε κάποιον αριθμό τηλεφώνου ή να μοιραστείτε προσωπικά δεδομένα. Αναφέρετε τυχόν ύποπτη δραστηριότητα μέσω της επιλογής «Αναφορά παραβίασης».

Μάθετε περισσότερα

Αυτό το νήμα έκλεισε και αρχειοθετήθηκε. Κάντε νέα ερώτηση αν χρειάζεστε βοήθεια.

Importing edited Mbox file from Gmail - Manipulation test

  • 1 απάντηση
  • 1 έχει αυτό το πρόβλημα
  • 130 προβολές
  • Τελευταία απάντηση από Matt

SuMo Bot
SuMo Bot

I am testing the theory behind manipulated emails and what forensic evidence can be obtained.

I notice that when Google Takeout is used to export emails from a Gmail account and are subsequently edited (in this case, the body text), SPF alters from "PASS" to "NONE with IP 0.0.0.0" and DKIM completely disappears in the "Original Message" view, however the headers remain unchanged with the exception of the edits to the body text.

The unedited email indicates SPF as "Pass" and DKIM as "Pass" (first image). This changes in the second image once any alteration is applied to the original email.

Before importing the email via Thunderbird, I delete the original email in Gmail (including the trash) and then load the manipulated email to Thunderbird and subsequently to the Gmail inbox.

Is there an explanation for the change in SPF and disappearance of DKIM to the manipulated email?

I am testing the theory behind manipulated emails and what forensic evidence can be obtained. I notice that when Google Takeout is used to export emails from a Gmail account and are subsequently edited (in this case, the body text), SPF alters from "PASS" to "NONE with IP 0.0.0.0" and DKIM completely disappears in the "Original Message" view, however the headers remain unchanged with the exception of the edits to the body text. The unedited email indicates SPF as "Pass" and DKIM as "Pass" (first image). This changes in the second image once any alteration is applied to the original email. Before importing the email via Thunderbird, I delete the original email in Gmail (including the trash) and then load the manipulated email to Thunderbird and subsequently to the Gmail inbox. Is there an explanation for the change in SPF and disappearance of DKIM to the manipulated email?

Όλες οι απαντήσεις (2)

Matt
Matt
  • Top 25 Contributor

Details on the SPF standard can be found here. https://datatracker.ietf.org/doc/html/rfc7208 and DKIM here https://datatracker.ietf.org/doc/html/rfc6376

Both of these are server side technologies and well beyond the scope of this forum.

SuMo Bot
SuMo Bot Ιδιοκτήτης ερώτησης

This question has been locked because the original author has deleted their account. While you can no longer post new replies, the existing content remains available for reference.