Lion Cipher Lab
Verify email authenticity with DKIM from scratch
- Threat Intel Analyst
- Advanced
- ~90 min
- Free · no account required
Why it matters
Business email compromise and credential phishing hinge on one trick: making a message look like it came from someone it did not. SPF, DKIM, and DMARC are the machinery that is supposed to stop that, and every SOC analyst reads their verdicts in mail headers daily — dkim=pass, spf=fail, dmarc=none. But a verdict you cannot reason about is a verdict you will misread. Analysts who trust a green 'dkim=pass' without asking whether the signing domain aligns with the visible sender miss forgeries that others catch, because a valid DKIM signature from attacker-owned throwaway.tld says nothing about…
What you'll learn
- Implementing DKIM relaxed/relaxed header and body canonicalization by hand
- Computing and comparing the DKIM body hash (bh=) with SHA-256
- Reconstructing the signed header string and RSA/SHA-256-verifying b=
- Reasoning about SPF, DKIM, and DMARC identifier alignment
- Distinguishing a body-hash failure from a signature failure when triaging a forged mail
- Explaining why a valid DKIM signature is not proof the From: domain is authentic
Steps in this lab
- Why you implement this once, by hand
- SPF, DKIM, and DMARC in plain terms
- Become your own DNS: generate the signing keypair
- Write the message you will sign
- Implement canonicalization and the body hash
- Sign the message from scratch
- Verify the signature — a clean PASS
- Break it: body tampering vs header tampering
- The phishing lesson: valid DKIM, failed alignment
- Limits, replay, and how a real analyst reads this