Sendgrid under siege from hacked accounts

Re:Sendgrid under siege from hacked accounts by jlgaddis on Saturday August 29, 2020 @03:21PM (#24318732)

This list is probably incomplete / out-of-date but ...

  149.72.0.0/16
  167.89.0.0/17
  168.245.0.0/17
  192.254.112.0/20
  198.21.0.0/21
  198.37.144.0/20

[ Parent | on HN ]

Re:Sendgrid under siege from hacked accounts by jeffbee on Saturday August 29, 2020 @03:28PM (#24318781)

Isn't their SPF record authoritative?

ip4:167.89.0.0/17 ip4:208.117.48.0/20 ip4:50.31.32.0/19 ip4:198.37.144.0/20 ip4:198.21.0.0/21 ip4:192.254.112.0/20 ip4:168.245.0.0/17 ip4:149.72.0.0/16

[ Parent | on HN ]

Re:Sendgrid under siege from hacked accounts by jlgaddis on Saturday August 29, 2020 @03:59PM (#24318971)

Usually, yeah, but not necessarily (e.g., for those with dedicated IP addresses).

Even then, it usually will be since most customers will just add the (customer-specific) "include:nnn.wl.sendgrid.net", or even just "include:sendgrid.net". But, for whatever reason, I've come across several that add an "a:" or "ip4:" for their dedicated IPs instead (I assume there's a good reason for that, but I don't know what it is).

[ Parent | on HN ]

Re:Sendgrid under siege from hacked accounts by megous on Saturday August 29, 2020 @05:52PM (#24319681)

Probably so that they can also send some mail from their own servers, in addition to sendgrid's.

[ Parent | on HN ]