2 ms·

I think it's difficult to prove, and the only people who care will be the domains owners that are impacted. If you send enough mail, you won't notice a few ext

by kxrm 5y ago

I think it's difficult to prove, and the only people who care will be the domains owners that are impacted. If you send enough mail, you won't notice a few extra emails going out from another account. Mailgun should have a way to monitor and block this. We used SMTP to interface with Mailgun and frankly, I didn't even think of this as being a vulnerability until I left the service. The DMARC reports just prove it was happening.

jrodom 5y ago
Josh/CTO of Mailgun here - I took a look at this case and these messages were being sent from the sandbox feature of our service. The sandbox only allows messages to be sent to "authorized recipients" through an opt-in mechanism, which makes it impractical for spamming and phishing. The purpose of this feature is to allow customers to get comfortable with the interfaces and test the product in a safe way without having to add DKIM/SPF records. I reviewed these messages and confirmed there is no illicit behavior, likely just a misconfiguration from a user of radiotoolbox.