News for hackers. Stuff that matters.

A comment on Mailgun doesn't validate the email headers of email sent through their system. Parent comment

Re:Mailgun doesn't validate the email headers of email sent ... by kxrm on Saturday November 13, 2021 @11:15AM (#29210796)
I think it's difficult to prove, and the only people who care will be the domains owners that are impacted. If you send enough mail, you won't notice a few extra emails going out from another account.

Mailgun should have a way to monitor and block this. We used SMTP to interface with Mailgun and frankly, I didn't even think of this as being a vulnerability until I left the service. The DMARC reports just prove it was happening.

[ Parent | on HN ]
Re:Mailgun doesn't validate the email headers of email sent ... by jrodom on Monday November 15, 2021 @02:45PM (#29231748)
Josh/CTO of Mailgun here - I took a look at this case and these messages were being sent from the sandbox feature of our service. The sandbox only allows messages to be sent to "authorized recipients" through an opt-in mechanism, which makes it impractical for spamming and phishing. The purpose of this feature is to allow customers to get comfortable with the interfaces and test the product in a safe way without having to add DKIM/SPF records. I reviewed these messages and confirmed there is no illicit behavior, likely just a misconfiguration from a user of radiotoolbox.
[ Parent | on HN ]