Mailgun: Public Security Disclosure

Re:Mailgun: Public Security Disclosure by nickphx on Tuesday July 11, 2023 @11:45AM (#36682633)

I'm not sure I understand the issue. What are you doing with the emails received via webhook that SPF/DKIM is needed? Are they being imported into a CRM and re-displayed? I treat any email message sent to the subdomain(s) configured for sending transactional / marketing messages as untrusted and act accordingly.

[ Parent | on HN ]

Re:Mailgun: Public Security Disclosure by throwaway2346mg on Wednesday July 12, 2023 @05:15AM (#36692090)

Yep - there are a number of scenarios:

- CRM system (obviously an issue) - Inbound email automation (eg. action based on reply from user / admin / etc)

But really, any inbound action where you don't want someone to be able to trivially spoof the sender, when the sender has SPF/DKIM/DMARC all configured.

For people using Mailgun purely for marketing email purposes, this is unlikely to be an issue, as you're unlikely to be using inbound routes for automation/processing.

[ Parent | on HN ]