Mailgun doesn't validate the email headers of email sent through their system

Re:Mailgun doesn't validate the email headers of email sent ... by kxrm on Saturday November 13, 2021 @11:59AM (#29211245)

True, but do you just allow them to borrow the reputation of your other customers? If a scammer knows example.com is a customer (DNS records will tell me this quickly) and a scammer decides to open an account and send as example.com through the service. Does Mailgun have no responsibility or ability to stop this behavior?

Seems easy enough to stop from what I know of email. Otherwise DKIM and SPF are worth nothing in systems like this.

[ Parent | on HN ]

Re:Mailgun doesn't validate the email headers of email sent ... by cdot2 on Saturday November 13, 2021 @12:12PM (#29211360)

Mailjet stops this by simply requiring domains to be registered to accounts before an account can send from that domain. Registering a domain requires adding a DNS record or file on that domain with a random unique guid

[ Parent | on HN ]

Re:Mailgun doesn't validate the email headers of email sent ... by kxrm on Saturday November 13, 2021 @12:43PM (#29211609)

Yep, and Mailgun requires a domain as well, they just don't do anything with it for filtering this behavior.

[ Parent | on HN ]

Re:Mailgun doesn't validate the email headers of email sent ... by jrodom on Monday November 15, 2021 @03:00PM (#29231931)

Josh CTO of Mailgun here - In this example, there is no actual sharing of domain reputation with other customers. Most inbox providers base reputation on the DKIM domain, which in this case is "sandbox.mgsend.net" not the header from address.

Each message is uniquely signed by the sending domain belonging to the account owner, meaning that the domain reputation cannot be borrowed/shared between customers.

[ Parent | on HN ]

Re:Mailgun doesn't validate the email headers of email sent ... by Asmod4n on Saturday November 13, 2021 @12:18PM (#29211404)

Hm, strato, 1and1 and t-online only have one mx and spf record for all customers. Allowing you to send as anyone they have in their system and make it look authentic.

[ Parent | on HN ]

Re:Mailgun doesn't validate the email headers of email sent ... by pbhjpbhj on Saturday November 13, 2021 @12:27PM (#29211478)

Surely they can cut off emails before it reaches the SMTP server though? Don't they have a milter that drops email sent by accounts that don't have the domain registered? They don't really forward spoofed mail do they??

[ Parent | on HN ]

Re:Mailgun doesn't validate the email headers of email sent ... by Asmod4n on Sunday November 14, 2021 @07:49AM (#29216902)

They do, they only check if you are allowed to log in.

Exchange even has a feature built in for exactly this, their send connectors can’t store more than one account.

[ Parent | on HN ]