News for hackers. Stuff that matters.

A comment on Comcast Shot Themselves in the Foot with MTA-STS. Parent comment

Re:Comcast Shot Themselves in the Foot with MTA-STS by tedunangst on Wednesday January 19, 2022 @05:55PM (#30001632)
This allows you to verify the mx record of the domain you're sending to, not the sender.
[ Parent | on HN ]
Re:Comcast Shot Themselves in the Foot with MTA-STS by wolverine876 on Wednesday January 19, 2022 @11:20PM (#30004566)
Thanks. Without trusting the MX record, how do you know from what address ask for the MX over HTTPS?

Maybe I should just look it up myself!

[ Parent | on HN ]
Re:Comcast Shot Themselves in the Foot with MTA-STS by tedunangst on Thursday January 20, 2022 @02:28AM (#30005845)
In theory, you cache a good copy from sometime before the attack.
[ Parent | on HN ]