18 ms·

Mailgun doesn't validate the email headers of email sent through their system

147 points by kxrm 5y ago

tedivm 5y ago
If accurate this means any mailgun user can pretend to be another one when sending email out- that's pretty damn bad. Since companies add mailgun to their SPF/DKIM records it means those spoofed emails will be hard to distinguish as fake.
- kxrm 5y ago
  I know it's accurate, I had another domain on my machine that was sending email through my account, on accident, and Mailgun did nothing to stop it.
  - ecf 5y ago
    Judging by the reputation of the new Mailgun owner, I wouldn’t be surprised to find out this is a feature for scammers, not a bug.
- vmception 5y ago
  I have been trying to tell people that this is happening for years. More about that spoofers were doing it, not what tools they were using I didn’t know I needed proof because people often resorted to victim blaming even though I never fell for any of the emails
  - kxrm 5y ago
    I think it's difficult to prove, and the only people who care will be the domains owners that are impacted. If you send enough mail, you won't notice a few extra emails going out from another account. Mailgun should have a way to monitor and block this. We used SMTP to interface with Mailgun and frankly, I didn't even think of this as being a vulnerability until I left the service. The DMARC reports just prove it was happening.
    - jrodom 5y ago
      Josh/CTO of Mailgun here - I took a look at this case and these messages were being sent from the sandbox feature of our service. The sandbox only allows messages to be sent to "authorized recipients" through an opt-in mechanism, which makes it impractical for spamming and phishing. The purpose of this feature is to allow customers to get comfortable with the interfaces and test the product in a safe way without having to add DKIM/SPF records. I reviewed these messages and confirmed there is no illicit behavior, likely just a misconfiguration from a user of radiotoolbox.
deleted 5y ago
[deleted]
Asmod4n 5y ago
Any Mail Server I encountered allowed you to put anything you want as the From header. With Microsoft Exchange being the exception.
- kxrm 5y ago
  True, but do you just allow them to borrow the reputation of your other customers? If a scammer knows example.com is a customer (DNS records will tell me this quickly) and a scammer decides to open an account and send as example.com through the service. Does Mailgun have no responsibility or ability to stop this behavior? Seems easy enough to stop from what I know of email. Otherwise DKIM and SPF are worth nothing in systems like this.
  - cdot2 5y ago
    Mailjet stops this by simply requiring domains to be registered to accounts before an account can send from that domain. Registering a domain requires adding a DNS record or file on that domain with a random unique guid
    - kxrm 5y ago
      Yep, and Mailgun requires a domain as well, they just don't do anything with it for filtering this behavior.
  - Asmod4n 5y ago
    Hm, strato, 1and1 and t-online only have one mx and spf record for all customers. Allowing you to send as anyone they have in their system and make it look authentic.
    - pbhjpbhj 5y ago
      Surely they can cut off emails before it reaches the SMTP server though? Don't they have a milter that drops email sent by accounts that don't have the domain registered? They don't really forward spoofed mail do they??
dazbradbury 5y ago
Mailgun used to be a HN favourite, great service, great customer support, and quickly resolving issues / providing solutions to problems like this (and many others). Email is hard, and mailgun made it less hard, helping you solve problems along the way. Several years ago, the customer service got worse, and the fixes / solutions stopped coming. I don't hold my breath that this (or any other issue) will be solved any time soon sadly. What service do HN recommend these days?
- z3ugma 5y ago
  Postmark, for sure. Run by a small dev shop called Wildbit that is bootstrapped, treats their employees fairly, and grows in small sustainable ways. https://postmarkapp.com/ https://postmarkapp.com/ https://wildbit.com/ https://wildbit.com/
  - agrunyan 5y ago
    Second this 100%. Postmark is my go-to for every project
    - evandwight 5y ago
      Why not use AWS ses? It's so much cheaper.
      - aledalgrande 5y ago
        UX and support?
      - svacko 5y ago
        One important decision argument against AWS SES is their policy to keep bounce rate below 5% (account put under review, if unresolevd until end of month, will be suspended, with hard limit of 10%) [1] compared to least strict Postmark's bounce rate of 10% [2]. Sometimes for SAAS products with a huge userbase or freemium pricing model is super difficult to keep the bounce rate so low for transactional emails. [1] https://docs.aws.amazon.com/pinpoint/latest/userguide/channels-email-deliverability-dashboard-bounce-complaint.html https://docs.aws.amazon.com/pinpoint/latest/userguide/channe... [2] https://postmarkapp.com/support/article/1137-servers-faq https://postmarkapp.com/support/article/1137-servers-faq
JanSt 5y ago
I‘m looking for an alternative to send mail and receive inbound mail. I‘d prefer to connect my domain so I can send from an API+interface (like gmail). Google does only allow 300 or so mails per day through SMTP. I‘d like to send more like 1000+ through an API (I’d like a combination of mailgun and gmail) Is there a service like this out there?
- kxrm 5y ago
  Mailgun does this, however I wouldn't recommend any of these services unless you are willing to fork out the cash for a static IP. The free tier or shared IP side is where these kinds of shenanigans can be played out.
  - JanSt 5y ago
    Yes, but they don‘t provide an interface for inbound mail, only redirecting, right?
    - kxrm 5y ago
      They have inbound on their paid tiers.
- johnchristopher 5y ago
  Mailjet ?
- legitster 5y ago
  Have you looked at Office 365/Outlook? A $100 a year subscription gets you a lot of firepower.
jbverschoor 5y ago
Mailgun doesn't even validate their own headers. I get daily emails from mailgun, which pass every check (spf, dkim, etc). Reported it a bunch of times, but gave up. No response, no fix... unfrotunate, because mailgun was a reaaally cool product
- emn13 5y ago
  Another anecdote of mailgun issues: we recently had an issue where a staging environment of ours started sending mails to real people. We use this staging environment to do as-much-as-possible end-to-end dry-runs of real work, and thought that mailgun's sandbox functionality would be an ideal fit for this - we get to test everything up to and including the mailgun api to find regressions or other issues. ...until it started sending real mails; and when we talked to their support staff the response was the frankly astonishing "yeah, that's by design, sandboxes will send real mail out of the sandbox when under unusually high load" (paraphrased). Seriously, W.T.F. Now, of course we can and do do normal testing with entirely fake data, but data-distribution dependent failures happen; that's kind of the whole point of a staging environment. I'm not sure what the point of mailgun's sandbox even is if it's useless for staging.
- jrodom 5y ago
  Josh/CTO of Mailgun here - Can you point me to any support tickets referencing this issue?
welder 5y ago
I wish Cloudflare provided an outgoing email API service. Seems like a good fit for their customers, and I bet they would take security more seriously than Mailgun.
rav 5y ago
I was recently looking into Mailgun's EU-hosted offering. Does anyone have recommendations for EU-based alternatives?
- rodelrod 5y ago
  Mailjet is a French company with a lot of compliance parlance in their website. They are now under the same company as Mailgun (Pathwire) and there are some weird mentions of Mailgun in the Mailjet docs, so I don't know where they're heading. I was considering using Mailjet, but from the docs it looks like the inbound processing is not as sophisticated as Mailgun: we can't set inbound routes dynamically according to the destination email address.
  - rav 5y ago
    In my initial investigation, I actually concluded that "Mailgun" and "Mailjet" were two product names from the same organization. I didn't realize they could be the result of a company merger. It's actually Mailjet with its outbound email templating service that I was considering using.
tehbeard 5y ago
Well.... thanks for ruining my weekend... Gonna be fun on Monday looking into this, talking with leads, and looking for Mailgun alternates.
- kxrm 5y ago
  If you pay for a static IP and tighten up your SPF records to just that IP rather than using Mailgun's include, you should be fine. It's bad that their service allows this at all, but it isn't the end of the world for all of their customers.
  - tehbeard 5y ago
    What trust do I have that a static IP would fix this? If the bug is before any routing to which server to send from takes place... then it'll just end going out on the static IP all the same..
    - kxrm 5y ago
      I was on the free tier so I don't know for sure, but I believe the whole point of the dedicated IP offering is you are the only customer who can use it. So long as your SPF records reflect just that IP SPF will remain in force if someone tries sending through one of the shared IPs as you. But if moving isn't a huge deal, there are plenty of recommendations in these comments of alternatives.
- welder 5y ago
  The Mailgun support also says DMARC records prevent this, when the reject policy is set to deny.
akach 5y ago
In UniOne.io, Mailgun rival, we ask each our customer to add separate DNS entry for a new domain proving that he/she owns the domain, and don't let another customer send using this domain.
- deleted 5y ago
  [deleted]
- pineconewarrior 5y ago
  Do you have a product that competes with MJML? Building email templates is hard - email client markup sucks.
  - akach 5y ago
    If the point is getting beautiful responsive emails without low-level HTML coding - well, yes, we have responsive email template builder integrated. Just with drag-n-drop you can get a nice template and then use it for your transactional or marketing emails.
i_have_an_idea 5y ago
If you're worried someone might spoof your domain, then use DMARC.

147 points by kxrm 5y ago

If accurate this means any mailgun user can pretend to be another one when sending email out- that's pretty damn bad. Since companies add mailgun to their SPF/DKIM records it means those spoofed emails will be hard to distinguish as fake.

kxrm 5y ago
I know it's accurate, I had another domain on my machine that was sending email through my account, on accident, and Mailgun did nothing to stop it.
- ecf 5y ago
  Judging by the reputation of the new Mailgun owner, I wouldn’t be surprised to find out this is a feature for scammers, not a bug.
vmception 5y ago
I have been trying to tell people that this is happening for years. More about that spoofers were doing it, not what tools they were using I didn’t know I needed proof because people often resorted to victim blaming even though I never fell for any of the emails
- kxrm 5y ago
  I think it's difficult to prove, and the only people who care will be the domains owners that are impacted. If you send enough mail, you won't notice a few extra emails going out from another account. Mailgun should have a way to monitor and block this. We used SMTP to interface with Mailgun and frankly, I didn't even think of this as being a vulnerability until I left the service. The DMARC reports just prove it was happening.
  - jrodom 5y ago
    Josh/CTO of Mailgun here - I took a look at this case and these messages were being sent from the sandbox feature of our service. The sandbox only allows messages to be sent to "authorized recipients" through an opt-in mechanism, which makes it impractical for spamming and phishing. The purpose of this feature is to allow customers to get comfortable with the interfaces and test the product in a safe way without having to add DKIM/SPF records. I reviewed these messages and confirmed there is no illicit behavior, likely just a misconfiguration from a user of radiotoolbox.

deleted 5y ago

[deleted]

Asmod4n 5y ago

Any Mail Server I encountered allowed you to put anything you want as the From header. With Microsoft Exchange being the exception.

kxrm 5y ago
True, but do you just allow them to borrow the reputation of your other customers? If a scammer knows example.com is a customer (DNS records will tell me this quickly) and a scammer decides to open an account and send as example.com through the service. Does Mailgun have no responsibility or ability to stop this behavior? Seems easy enough to stop from what I know of email. Otherwise DKIM and SPF are worth nothing in systems like this.
- cdot2 5y ago
  Mailjet stops this by simply requiring domains to be registered to accounts before an account can send from that domain. Registering a domain requires adding a DNS record or file on that domain with a random unique guid
  - kxrm 5y ago
    Yep, and Mailgun requires a domain as well, they just don't do anything with it for filtering this behavior.
- Asmod4n 5y ago
  Hm, strato, 1and1 and t-online only have one mx and spf record for all customers. Allowing you to send as anyone they have in their system and make it look authentic.
  - pbhjpbhj 5y ago
    Surely they can cut off emails before it reaches the SMTP server though? Don't they have a milter that drops email sent by accounts that don't have the domain registered? They don't really forward spoofed mail do they??

dazbradbury 5y ago

Mailgun used to be a HN favourite, great service, great customer support, and quickly resolving issues / providing solutions to problems like this (and many others). Email is hard, and mailgun made it less hard, helping you solve problems along the way. Several years ago, the customer service got worse, and the fixes / solutions stopped coming. I don't hold my breath that this (or any other issue) will be solved any time soon sadly. What service do HN recommend these days?

z3ugma 5y ago
Postmark, for sure. Run by a small dev shop called Wildbit that is bootstrapped, treats their employees fairly, and grows in small sustainable ways. https://postmarkapp.com/ https://postmarkapp.com/ https://wildbit.com/ https://wildbit.com/
- agrunyan 5y ago
  Second this 100%. Postmark is my go-to for every project
  - evandwight 5y ago
    Why not use AWS ses? It's so much cheaper.
    - aledalgrande 5y ago
      UX and support?
    - svacko 5y ago
      One important decision argument against AWS SES is their policy to keep bounce rate below 5% (account put under review, if unresolevd until end of month, will be suspended, with hard limit of 10%) [1] compared to least strict Postmark's bounce rate of 10% [2]. Sometimes for SAAS products with a huge userbase or freemium pricing model is super difficult to keep the bounce rate so low for transactional emails. [1] https://docs.aws.amazon.com/pinpoint/latest/userguide/channels-email-deliverability-dashboard-bounce-complaint.html https://docs.aws.amazon.com/pinpoint/latest/userguide/channe... [2] https://postmarkapp.com/support/article/1137-servers-faq https://postmarkapp.com/support/article/1137-servers-faq

JanSt 5y ago

I‘m looking for an alternative to send mail and receive inbound mail. I‘d prefer to connect my domain so I can send from an API+interface (like gmail). Google does only allow 300 or so mails per day through SMTP. I‘d like to send more like 1000+ through an API (I’d like a combination of mailgun and gmail) Is there a service like this out there?

kxrm 5y ago
Mailgun does this, however I wouldn't recommend any of these services unless you are willing to fork out the cash for a static IP. The free tier or shared IP side is where these kinds of shenanigans can be played out.
- JanSt 5y ago
  Yes, but they don‘t provide an interface for inbound mail, only redirecting, right?
  - kxrm 5y ago
    They have inbound on their paid tiers.
johnchristopher 5y ago
Mailjet ?
legitster 5y ago
Have you looked at Office 365/Outlook? A $100 a year subscription gets you a lot of firepower.

jbverschoor 5y ago

Mailgun doesn't even validate their own headers. I get daily emails from mailgun, which pass every check (spf, dkim, etc). Reported it a bunch of times, but gave up. No response, no fix... unfrotunate, because mailgun was a reaaally cool product

emn13 5y ago
Another anecdote of mailgun issues: we recently had an issue where a staging environment of ours started sending mails to real people. We use this staging environment to do as-much-as-possible end-to-end dry-runs of real work, and thought that mailgun's sandbox functionality would be an ideal fit for this - we get to test everything up to and including the mailgun api to find regressions or other issues. ...until it started sending real mails; and when we talked to their support staff the response was the frankly astonishing "yeah, that's by design, sandboxes will send real mail out of the sandbox when under unusually high load" (paraphrased). Seriously, W.T.F. Now, of course we can and do do normal testing with entirely fake data, but data-distribution dependent failures happen; that's kind of the whole point of a staging environment. I'm not sure what the point of mailgun's sandbox even is if it's useless for staging.
jrodom 5y ago
Josh/CTO of Mailgun here - Can you point me to any support tickets referencing this issue?

welder 5y ago

I wish Cloudflare provided an outgoing email API service. Seems like a good fit for their customers, and I bet they would take security more seriously than Mailgun.

rav 5y ago

I was recently looking into Mailgun's EU-hosted offering. Does anyone have recommendations for EU-based alternatives?

rodelrod 5y ago
Mailjet is a French company with a lot of compliance parlance in their website. They are now under the same company as Mailgun (Pathwire) and there are some weird mentions of Mailgun in the Mailjet docs, so I don't know where they're heading. I was considering using Mailjet, but from the docs it looks like the inbound processing is not as sophisticated as Mailgun: we can't set inbound routes dynamically according to the destination email address.
- rav 5y ago
  In my initial investigation, I actually concluded that "Mailgun" and "Mailjet" were two product names from the same organization. I didn't realize they could be the result of a company merger. It's actually Mailjet with its outbound email templating service that I was considering using.

tehbeard 5y ago

Well.... thanks for ruining my weekend... Gonna be fun on Monday looking into this, talking with leads, and looking for Mailgun alternates.

kxrm 5y ago
If you pay for a static IP and tighten up your SPF records to just that IP rather than using Mailgun's include, you should be fine. It's bad that their service allows this at all, but it isn't the end of the world for all of their customers.
- tehbeard 5y ago
  What trust do I have that a static IP would fix this? If the bug is before any routing to which server to send from takes place... then it'll just end going out on the static IP all the same..
  - kxrm 5y ago
    I was on the free tier so I don't know for sure, but I believe the whole point of the dedicated IP offering is you are the only customer who can use it. So long as your SPF records reflect just that IP SPF will remain in force if someone tries sending through one of the shared IPs as you. But if moving isn't a huge deal, there are plenty of recommendations in these comments of alternatives.
welder 5y ago
The Mailgun support also says DMARC records prevent this, when the reject policy is set to deny.

akach 5y ago

In UniOne.io, Mailgun rival, we ask each our customer to add separate DNS entry for a new domain proving that he/she owns the domain, and don't let another customer send using this domain.

deleted 5y ago
[deleted]
pineconewarrior 5y ago
Do you have a product that competes with MJML? Building email templates is hard - email client markup sucks.
- akach 5y ago
  If the point is getting beautiful responsive emails without low-level HTML coding - well, yes, we have responsive email template builder integrated. Just with drag-n-drop you can get a nice template and then use it for your transactional or marketing emails.

i_have_an_idea 5y ago

If you're worried someone might spoof your domain, then use DMARC.