all-in-one privacy solution":["Proton Unlimited is een all-in-one privacy-oplossing"],"Black Friday":["Black Friday"],"No ads. Privacy by default.":["Geen advertenties. Standaard privacy."],"People before profits":["Mensen vóór winst"],"Security through transparency":["Veiligheid door openheid"],"The best Proton Mail ${ BLACK_FRIDAY } deals":["De beste ${ BLACK_FRIDAY }-deals voor Proton Mail"],"The world’s only community- supported email service":["'s Werelds enige door de community ondersteunde e-mailservice"]},"specialoffer:limited":{"${ hours } hour":["${ hours } uur","${ hours } uur"],"${ hoursLeft }, ${ minutesLeft } and ${ secondsLeft } left":["Nog ${ hoursLeft }, ${ minutesLeft } en ${ secondsLeft } resterend"],"${ minutes } minute":["${ minutes } minuut","${ minutes } minuten"],"${ seconds } second":["${ seconds } seconde","${ seconds } seconden"],"Limited time offer":["Aanbieding beperkt geldig"]},"specialoffer:listitem":{"Create multiple addresses":["Maak meerdere e-mailadressen aan"],"Hide-my-email aliases":["Hide-my-email-aliassen"],"Quickly unsubscribe from newsletters":["Meld u eenvoudig af voor nieuwsbrieven"],"Use your own domain name":["Gebruik uw eigen domeinnaam"]},"specialoffer:logos":{"As featured in":["Zoals te lezen in"]},"specialoffer:metadescription":{"Get an encrypted email that protects your privacy":["Kies voor beveiligde e-mail die uw privacy beschermt"]},"specialoffer:metatitle":{"Proton Mail Black Friday Sale - Up to 40% off":["Proton Mail Black Friday Sale - Tot 40% korting"]},"specialoffer:newmetadescription":{"Get up to 40% off Proton Mail subscriptions this Black Friday. Find great deals on our secure end-to-end encrypted email plans.":["Profiteer tijdens Black Friday van wel 40% korting op Proton Mail-abonnementen. Bekijk geweldige aanbiedingen voor onze veilige, end-to-end versleutelde e-mailabonnementen."]},"specialoffer:newmetatitle":{"Proton Mail Black Friday sale | Up to 40% off secure email":["Proton Mail Black Friday Sale | Tot 40% korting op veilige e-mail"]},"specialoffer:note":{"* Billed at ${ TOTAL_SUM } for the first year":["*U betaalt ${ TOTAL_SUM } voor het eerste jaar"],"*Billed at ${ TOTAL_SUM } for the first 2 years":["*U betaalt ${ TOTAL_SUM } voor de eerste 2 jaar"],"30-day money-back guarantee":["30 dagen niet-goed-geld-terug-garantie"],"Billed at ${ TOTAL_SUM } for the first 2 years":["U betaalt ${ TOTAL_SUM } voor de eerste 2 jaar"],"Billed at ${ TOTAL_SUM } for the first year":["U betaalt ${ TOTAL_SUM } voor het eerste jaar"],"You save ${ SAVE_SUM }":["U bespaart ${ SAVE_SUM }"]},"specialoffer:off":{"${ DISCOUNT } off":["−${ DISCOUNT }"],"${ PERCENT_OFF } off":["−${ PERCENT_OFF }"]},"specialoffer:testimonial":{"I love my ProtonMail":["Ik ben fan van ProtonMail"],"My favorite email service":["Mijn favoriete e-mailservice"],"Thanks Proton for keeping us all safe in the complicated internet universe.":["Proton houdt ons allemaal veilig in het complexe internetuniversum."],"You get what you pay for. In the case of big tech, if you pay nothing, you get used. I quit using Gmail and switched to @ProtonMail":["Je krijgt waarvoor je betaalt. In het geval van Big Tech betekent 'gratis' dat je wordt gebruikt. Ik ben gestopt met Gmail en overgestapt op @ProtonMail"]},"specialoffer:time":{"Days":["Dagen"],"Hours":["Uur"],"Min":["Min"]},"specialoffer:title":{"And much more":["En nog veel meer"],"Make your inbox yours":["Personaliseer uw inbox"],"Safe from trackers":["Beschermd tegen trackers"],"Stay organized":["Houd overzicht"],"Black Friday email deals":["Black Friday-deals voor e-mail"],"Don’t just take our word for it":["U hoeft ons niet te geloven"],"Our story":["Ons verhaal"],"Transfer your data from Google in one click":["Zet uw gegevens van Google over met één klik"]},"specialoffer:tooltip":{"Access blocked content and browse privately. Includes ${ TOTAL_SERVERS }+ servers in ${ TOTAL_COUNTRIES }+ countries, connect up to 10 devices, access worldwide streaming services, malware and ad-blocker, and more.":["Bekijk geblokkeerde inhoud en surf privé. Met ${ TOTAL_SERVERS } servers in meer dan ${ TOTAL_COUNTRIES } landen, verbinding met maximaal 10 apparaten, wereldwijd toegang tot streamingdiensten, malware- en advertentieblokkering, en meer."],"Easily share your calendar with your family, friends or colleagues, and view external calendars.":["Deel uw agenda eenvoudig met uw familie, vrienden of collega's, en bekijk externe agenda's."],"Includes support for 1 custom email domain, 10 email addresses, 10 hide-my-email aliases, calendar sharing, and more.":["Ondersteuning voor 1 aangepast e-maildomein, 10 e-mailadressen, 10 hide-my-email-aliassen, gedeelde agenda's en meer."],"Includes support for 3 custom email domains, 15 email addresses, unlimited hide-my-email aliases, calendar sharing, and more.":["Ondersteuning voor 3 aangepaste e-maildomeinen, 15 e-mailadressen, onbeperkt hide-my-email-aliassen, gedeelde agenda's en meer."],"Manage up to 25 calendars, mobile apps, secured with end-to-end encryption, 1-click calendar import from Google, and more.":["Beheer tot 25 agenda's, mobiele apps, beveiligd met end-to-end versleuteling, agenda's van Google importeren met 1 klik, en meer."]},"Status Banner":{"At the moment we are experiencing issues with the Proton VPN service":["Momenteel werkt de dienst van Proton VPN niet naar behoren"],"Learn more":["Meer informatie"]},"Status banner":{"Learn more":["Meer informatie"],"Please note that at the moment we are experiencing issues with the ${ issues[0] } service.":["We ondervinden op dit moment problemen met de ${ issues[0] }service."],"We are experiencing issues with one or more services at the moment.":["We ondervinden momenteel problemen met een of meer services."]},"suggestions":{"Suggestions":["Suggesties"]},"Support":{"Sub category":["Subcategorie","Subcategorieën"]},"Support article":{"${ readingTime } min":["${ readingTime } min","${ readingTime } min"],"Category":["Categorie","Categorieën"],"Didn’t find what you were looking for?":["Niet gevonden wat u zocht?"],"General contact":["Algemene contactgegevens"],"Get help":["Krijg hulp"],"Legal contact":["Contactgegevens voor juridische zaken"],"Media contact":["Contactgegevens voor media"],"Partnerships contact":["Contactgegevens voor partnerschappen"],"Reading":["Lezen"]},"Support categories":{"Browse Proton product support":["Zoeken in Proton-productondersteuning"]},"Support category":{"There is no article in this category yet.":["Er zijn nog geen artikelen in deze categorie."]},"Support troubleshooting":{"--- Select ---":["--- Selecteren ---"],"App version":["App-versie"],"Browser":["Browser"],"Check if this helps":["Kijk of dit helpt"],"Choose a category for your question":["Kies een categorie voor uw vraag"],"Choose a product":["Kies een product"],"Did this solve your issue ?":["Heeft dit uw probleem opgelost?"],"Faster assistance is just a few clicks away — please make your selections":["Snellere ondersteuning binnen een paar klikken — maak uw keuze"],"No, contact support":["Nee, contact opnemen met ondersteuning"],"Proton account":["Proton-account"],"Proton Bridge":["Proton Bridge"],"Proton Calendar":["Proton Calendar"],"Proton Drive":["Proton Drive"],"Proton for Business":["Proton for Business"],"Proton Mail":["Proton Mail"],"Proton Pass":["Proton Pass"],"Proton VPN":["Proton VPN"],"Thank you for your feedback":["Bedankt voor uw feedback"],"Troubleshooting":["Probleemoplossing"],"What can we help with ?":["Waar mogen we u bij helpen?"],"Yes":["Ja"]},"support_modal_search_query":{"Search query":["Zoekopdracht"]},"support_search_button":{"Search":["Zoeken"]},"support_search_i_am_looking_for":{"I'm looking for":["Ik ben op zoek naar"]},"SupportForm":{"For a faster resolution, please report the issue from the Bridge app: Help > Report a problem.":["Om problemen sneller op te lossen, meldt u het via de Bridge-app: Help > Een probleem melden."],"Information":["Informatie"]},"SupportForm:option":{"Account Security":["Accountbeveiliging"],"Contacts":["Contactpersonen"],"Custom email domain":["Aangepast e-maildomein"],"Email delivery and Spam":["E-maillevering en spam"],"Encryption":["Versleuteling"],"Login and password":["Inlognaam en wachtwoord"],"Merge aliases and accounts":["Aliassen en accounts samenvoegen"],"Migrate to Proton":["Migreren naar Proton"],"Notifications":["Meldingen"],"Other":["Overig"],"Plans and billing":["Abonnementen en facturering"],"Proton for Business":["Proton for Business"],"Sign up":["Inschrijven"],"Storage":["Opslag"],"Users, addresses, and identities":["Gebruikers, adressen en identiteiten"]},"SupportForm:optionIntro":{"Select a topic":["Kies een onderwerp"]},"swiss_baseed_feature":{"Swiss based":["Gevestigd in Zwitserland"]},"Testimonial":{"Awards":["Awards"],"Customers":["Klanten"],"Featured":["Featured"],"Go to testimonial source":["Naar bron van testimonial"],"Reviews":["Reviews"],"Videos":["Video's"]},"Text":{"Find the plan that's right for you":["Vind het abonnement dat bij u past"],"If you need help, check out our ${ supportLink }.":["Bekijk onze ${ supportLink } als u hulp nodig hebt."],"The page you’re looking for might have been removed, or it could be an\nold link.":["De pagina waarnaar u op zoek bent, is mogelijk verwijderd, of u gebruikt een oude koppeling."]},"Tooltip":{"More information":["Meer informatie"]},"tooltip_calendar":{"Create up to 20 custom & shareable encrypted calendars. On top of that, add up to 5 calendars from friends, family, colleagues, and organizations.":["Maak tot 20 aangepaste en deelbare versleutelde agenda's aan. Voeg daar bovenop tot 5 agenda's toe van vrienden, familie, collega's en organisaties."]},"tooltip_vpn":{"Access blocked content and browse privately. Includes ${ TOTAL_SERVERS }+ servers in ${ TOTAL_COUNTRIES }+ countries, highest VPN speed, ${ TOTAL_VPN_CONNECTIONS } VPN connections, worldwide streaming services, malware and ad-blocker, and more.":["Bekijk geblokkeerde inhoud en surf privé. Met meer dan ${ TOTAL_SERVERS } servers in meer dan ${ TOTAL_COUNTRIES } landen, de hoogste VPN-snelheid, ${ TOTAL_VPN_CONNECTIONS } VPN-verbindingen, wereldwijde streamingdiensten, malware- en advertentieblokkering, en meer."],"Access blocked content and browse privately. Includes ${ TOTAL_SERVERS }+ servers in ${ TOTAL_COUNTRIES }+ countries, highest VPN speed, 10 VPN connections, worldwide streaming services, malware and ad-blocker, and more.":["Bekijk geblokkeerde inhoud en surf privé. Met meer dan ${ TOTAL_SERVERS } servers in meer dan ${ TOTAL_COUNTRIES } landen, de hoogste VPN-snelheid, 10 VPN-verbindingen, wereldwijde streamingdiensten, malware- en advertentieblokkering, en meer."]},"version_history_label":{"Version history":["Versiegeschiedenis"]},"version_history_tooltip":{"Store up to ${ versionHistoryNumber } versions of each file for up to ${ years } years":["Bewaar tot ${ versionHistoryNumber } versies van elk bestand tot wel ${ years } jaar"]},"vpn_features_link":{"View VPN plans":["VPN-abonnementen bekijken"]},"vpn_features_useCase":{"Access blocked content and browse privately":["Bekijk geblokkeerde inhoud en surf privé"]}}},"unleashApi":"https://account.proton.me/api"};
// We need to import data (the framework context) from the server
// This Astro feature with define:vars works well but creates an inline script
// So we can't directly import the initFramework helper, we have to store the context
window.frameworkContext = frameworkContext;
})();
On 1 December 2021, we began receiving sporadic reports of delivery failures from proton.me addresses to Gmail. This corresponded with a dramatic decline in proton.me’s domain reputation as seen via Gmail Postmaster Tools and an increase in sending from known bad IP addresses.
It was clear both from the bad sending IPs (mostly in Russia) and our own metrics that the spam emails damaging Proton Mail’s domain reputation were not coming from our servers. However, the Postmaster Tools indicated that all emails being received by Gmail from proton.me were “fully authenticated”, including the fraudulent ones.
This, in turn, caused the fraudulent emails to feed into Google’s algorithm for determining domain reputation and lowered it enough that the deliverability of legitimate emails from our servers was affected as well.
We suspected a DKIM replay attack, where a single spam email originally sent from Proton Mail was being resent to many Gmail users in an attempt to exploit our deliverability and reputation to get around Google’s anti-spam measures. At one point, roughly 98% of the emails Gmail received that claimed to be from Proton Mail were actually spam, meaning the spammers were sending an amount of emails that was equivalent to 50 times our normal outgoing traffic to Google.
We immediately rotated our DKIM signing key to (temporarily) prevent the emails from passing DKIM and contacted Google’s counter-abuse team, who quickly implemented a fix to Gmail’s spam filters and restored legitimate email delivery.
Emails sent from proton.me, proton.me/mail, and custom domains were not affected by this issue.
How DKIM replay attacks work
Before we can explain how this happened, we first need to outline how emails are structured, delivered, and authenticated on the internet.
Emails are MIME (Multipurpose Internet Mail Extensions) messages, consisting of headers and sections that contain the message body and possibly attachments. The headers contain some fields that will be familiar to any email user (To, CC, From, Subject) but also hidden information that is used to authenticate the email.
However, none of the headers are actually used to route the email to its final destination. The recipient and sender of the email are specified separately as part of the email envelope, which is a very suitable metaphor. If the email message, including its headers, is equivalent to a paper letter, then the email envelope in which the “letter” is placed contains the recipient and return addresses, like a real envelope.
The key point is that the recipient on the envelope does not have to match any recipient in the To or CC headers — typical examples of this are emails sent via BCC or addressed to “undisclosed recipients”.
Perhaps even more surprisingly, the envelope sender does not have to match the email From header. This also has a legitimate purpose — mass mailings often specify a different “return address” than the From header to analyze deliverability problems or use third-party services to send emails. This flexibility is also important for enabling users to forward messages from one mailbox to another.
These return addresses are authenticated via SPF (Sender Policy Framework), which authorizes the sending of messages by specific servers or IP addresses using special DNS records. But this only validates the server sending the email; it does not ensure that the email’s content has not been tampered with. For that, we need DKIM (Domain Keys Identified Mail).
DKIM also uses special DNS records, but rather than a list of IP addresses, these records contain keys used to sign the email content and certain associated headers. The resulting cryptographic signature is appended to the message as a special header, and the recipient mail server or client can verify this signature against the email content on delivery. But the DKIM domain in the signature can also be different from the one in the From header in the message itself. If the DKIM signature is verified, this only confirms that the message went through the signing domain’s mail servers and has not been modified since, not that the message originated from where it claims.
To actually verify that the domain in the From header sent the message, we need DMARC (Domain-based Message Authentication, Reporting, and Conformance). To pass DMARC, an email must pass either SPF or DKIM, and the domain in the From header must be “aligned” with the corresponding SPF or DKIM domain. The From header is what the user ultimately sees, so DMARC is a critical part of ensuring that an email originated from where it claims it did as it is the only policy that connects the From header to either the sending or signing domain.
Now let’s return to the attack. The reason that DKIM replay attacks work and why Gmail considered those replayed spam mails “authenticated” comes down to the fact that DMARC requires DKIM or SPF alignment, but not both. The replayed message itself had a valid DKIM signature from proton.me, which meant it passed DMARC. This message was then sent enough times that it influenced proton.me’s domain reputation in Gmail’s system, eventually becoming low enough to affect deliverability for legitimate email.
How we prevent replay attacks
The fact that DMARC passes if either the DKIM domain or the SPF domain align with the From domain is a feature of the specification, not a bug. In particular, it enables email forwarding and allows email sending by trusted third parties. However, for email service providers, such as Proton, Gmail, or Yahoo, it also enables these kinds of replay attacks, as any user can send an email, get it signed by the corresponding domain, then resend it with the signature intact.
This is one reason that Proton and other email providers invest heavily in their own anti-spam technology and systems. These systems are complex and often rely on complicated heuristics to separate spam from legitimate email. In this case, the attackers found a vulnerability in Gmail’s anti-spam system and were able to exploit it.
We appreciate Google’s responsiveness in addressing the issue.
How you can prevent domain impersonation on your domain
DKIM replay attacks are an issue primarily for email service providers or other organizations that offer email addresses on a shared domain. However, email authentication attacks in general are a risk for any organization. Here are some tips to help you ensure no one else can impersonate your domain or use it to send fraudulent messages.
Set up SPF, DKIM, and DMARC – Although imperfect, these policies are key to ensuring that your emails are delivered and resistant to being spoofed. If you use Proton to host your domain, our domain setup wizard will explain how to set it up and protect it from being spoofed.
Rotate your DKIM keys regularly – Rotating our DKIM keys allowed us to quickly stop the attack and buy time for the permanent solution. Although tedious and risky to do manually, Proton’s DKIM key management system(new window) allowed us to easily do this in minutes, and this system is the same system used for all domains hosted at Proton. The system also automatically rotates keys regularly to reduce the risk of key compromise.
Oversign From, To, and CC headers – Most DKIM implementations always sign the From, To, and CC headers if they are present in an email, preventing them from being modified if the message is resent. However, if these headers are missing, they are often unsigned, opening the door to replay attacks with forged headers that make the fraudulent emails seem legitimate. Oversigning mitigates these attacks by signing these sensitive headers in all cases, even if they are blank. If you use Proton to send your email, this oversigning is done for you automatically by our mail servers.
Be careful of subdomains – If you use CNAME records to delegate parts of your website to third parties, you may be also allowing these third parties to send email on behalf of your main domain. This is because, by default, DMARC considers domains aligned if they have a parent-child relationship — that is, sub.example.com aligns with example.com. You can force exact match alignment for SPF, DKIM, or both with the aspf and adkim options in your DMARC policy. However, be aware that this can affect third-party mailing service integrations.
A lot happens after you click Send in Proton Mail
If we’re doing everything correctly on our end, email delivery seems as easy as a single click, but the truth is that it relies on a complex web of interlocking, interdependent policies. Events like this replay attack demonstrate just how complicated it can be to verify something as seemingly simple as “Who sent this email?”
At Proton Mail, we are constantly investigating new protocols and policies to ensure that the millions of emails sent using our platform every day are delivered reliably and securely. We also continuously monitor incoming mail to ensure our authentication checking has been optimized and we have systems and analysts in place 24/7 to mitigate spam and phishing attacks.
This is a vital part of creating an internet where privacy is the default, and we could not do it without the support of the Proton community. Thank you.
Google is one of the biggest obstacles to privacy. The Big Tech giant may offer
quick access to information online, but it also controls vast amounts of your
personal or business data.
Recently, more people are becoming aware of the actual price you
If you’re a United States citizen or permanent resident, you have a Social
Security number (SSN). This number is the linchpin of much of your existence,
linked to everything from your tax records to your credit cards. Theft is a
massive problem, whic
Compromised passwords are a common issue and probably one of the biggest
cybersecurity threats for regular people. How do passwords get compromised, and
is there anything you can do to prevent it?
* What does compromised password mean?
* How do pa
WeTransfer is a popular service used by millions worldwide to send large files.
You may have wondered if it’s safe or whether you should use it to share
sensitive files. We answer these questions below and present a WeTransfer
alternative that may su
Dictionary attacks are a common method hackers use to try to crack passwords and
break into online accounts.
While these attacks may be effective against people with poor account security,
it’s extremely easy to protect yourself against them by usi
Data breaches are increasingly common. Whenever you sign up for an online
service, you provide it with personal information that’s valuable to hackers,
such as email addresses, passwords, phone numbers, and more. Unfortunately, many
online services f