News for hackers. Stuff that matters.

A comment on Mailgun doesn't validate the email headers of email sent through their system. Parent comment

Re:Mailgun doesn't validate the email headers of email sent ... by Asmod4n on Saturday November 13, 2021 @12:18PM (#29211404)
Hm, strato, 1and1 and t-online only have one mx and spf record for all customers. Allowing you to send as anyone they have in their system and make it look authentic.
[ Parent | on HN ]
Re:Mailgun doesn't validate the email headers of email sent ... by pbhjpbhj on Saturday November 13, 2021 @12:27PM (#29211478)
Surely they can cut off emails before it reaches the SMTP server though? Don't they have a milter that drops email sent by accounts that don't have the domain registered? They don't really forward spoofed mail do they??
[ Parent | on HN ]
Re:Mailgun doesn't validate the email headers of email sent ... by Asmod4n on Sunday November 14, 2021 @07:49AM (#29216902)
They do, they only check if you are allowed to log in.

Exchange even has a feature built in for exactly this, their send connectors can’t store more than one account.

[ Parent | on HN ]