News for hackers. Stuff that matters.

A comment on Mailgun: Public Security Disclosure.

Re:Mailgun: Public Security Disclosure by Padlock4543 on Tuesday July 11, 2023 @07:15AM (#36679348)
I don't fully understand what the role of the inbound service is on "setting headers".

I believe SPF/DKIM/DMARC are mostly (not fully) DNS verifications. Shouldn't these be setup by the domain owner (sender/outbound)?

Is the problem that they don't do the verifications for SPF/DKIM/DMARC for inbound emails?

[ Parent | on HN ]
Re:Mailgun: Public Security Disclosure by throwaway2346mg on Tuesday July 11, 2023 @08:18AM (#36679931)
> Is the problem that they don't do the verifications for SPF/DKIM/DMARC for inbound emails?

Yes - the result of the checks aren't passed through for inbound emails (when sent to webhooks).

[ Parent | on HN ]