Mastering Modern Red Teaming Infrastructure – Part 3

Securing Mail Services with DNS Records


Introduction

Email remains the most effective and reliable initial access vector in real-world attacks and red team engagements. However, modern organizations deploy advanced email gateways, reputation engines, and content inspection controls that quickly block poorly configured domains.

This chapter focuses on building a legitimate-looking mail infrastructure using correct DNS records and mail service configuration. The objective is not abuse, but understanding how attackers improve deliverability and credibility, and how defenders can better detect misuse.


Why Mail Infrastructure Matters

Mail security solutions heavily rely on:

  • Domain reputation

  • DNS-based authentication

  • Historical sending behavior

A domain without proper mail records is immediately flagged as suspicious. Correctly configured mail services significantly increase inbox placement and reduce automated filtering.


Core Mail Authentication Records

Modern email authentication relies on three key DNS records:

1. SPF (Sender Policy Framework)

Defines which servers are allowed to send email on behalf of a domain.

Example SPF record:

Purpose:

  • Prevents spoofing

  • Helps receivers validate sender legitimacy


2. DKIM (DomainKeys Identified Mail)

Cryptographically signs outgoing messages.

How it works:

  • Mail server signs the message with a private key

  • Receiver validates signature using public key in DNS

DKIM records are provided by the mail provider and added as TXT records.


3. DMARC (Domain-based Message Authentication)

Defines how receivers should handle failed SPF/DKIM checks.

Initial recommended policy:

This allows monitoring without rejecting messages.


Step 1 – Choosing a Mail Provider

For this setup, Zoho Mail is used due to:

  • Easy DNS integration

  • Good reputation

  • Free tier availability

Other providers may be substituted based on engagement needs.

Zoho Mail: https://www.zoho.com/mail/


Step 2 – Domain Verification

After adding your domain in Zoho Mail:

  1. Zoho provides a TXT verification record

  2. Add this TXT record in your DNS provider (e.g., Cloudflare)

  3. Wait for propagation and verify ownership

Verification confirms control over the domain.


Step 3 – Configuring DNS Records

All records are added at the DNS provider.

Required Records

MX Records

Direct incoming mail to Zoho servers.

Example:


SPF Record

Ensures only Zoho can send mail.


DKIM Record

Provided by Zoho as a TXT record:

Used to validate message integrity.


DMARC Record

Used for reporting and policy enforcement.


Step 4 – Validating Mail Configuration

After DNS propagation, validate configuration using:

Mail Tester: https://www.mail-tester.com/

This checks:

  • SPF/DKIM/DMARC alignment

  • Spam score

  • Blacklist status

  • Header anomalies

Fix all issues before operational use.


Step 5 – Mail Reputation Warm-Up

Fresh domains sending large volumes are suspicious.

Best practices:

  • Start with low-volume emails

  • Send benign content first

  • Gradually increase sending rate

  • Avoid links and attachments initially

This builds positive reputation over time.


Step 6 – Content OPSEC

Mail content plays a major role in filtering.

Guidelines:

  • Avoid spam keywords

  • Use natural language

  • Personalize messages

  • Match corporate tone and formatting

HTML templates should resemble legitimate business communication.


Step 7 – Attachment Handling

Attachments are heavily inspected.

Operational techniques:

  • Use password-protected ZIP files

  • Send password in separate channel or email

  • Use less common but legitimate file formats

Always test attachments against mail gateways before use.


Monitoring and Maintenance

Continuously monitor:

  • Domain reputation

  • Mail delivery reports

  • DMARC aggregate reports

  • Bounce and complaint rates

Tools:

  • Mail Tester

  • Google Admin Toolbox

  • MXToolbox


Defensive Perspective

From a defensive standpoint, this infrastructure highlights:

  • DNS records alone do not guarantee legitimacy

  • Attackers can fully comply with mail standards

  • Behavioral analysis is critical

SOC teams should monitor:

  • Newly active mail domains

  • Sudden changes in sending patterns

  • DMARC report anomalies


Key Takeaways

Properly configured mail infrastructure:

  • Improves deliverability

  • Increases credibility

  • Reduces automated blocking

Understanding these techniques enables:

  • Better red team realism

  • Improved blue team detection

  • Stronger email security posture


Disclaimer

This document is intended for educational and defensive security awareness purposes only.


Last updated