3 ms·
True, but do you just allow them to borrow the reputation of your other customers? If a scammer knows example.com is a customer (DNS records will tell me this
by kxrm 5y ago
True, but do you just allow them to borrow the reputation of your other customers? If a scammer knows example.com is a customer (DNS records will tell me this quickly) and a scammer decides to open an account and send as example.com through the service. Does Mailgun have no responsibility or ability to stop this behavior?
Seems easy enough to stop from what I know of email. Otherwise DKIM and SPF are worth nothing in systems like this.
- cdot2 5y agoMailjet stops this by simply requiring domains to be registered to accounts before an account can send from that domain. Registering a domain requires adding a DNS record or file on that domain with a random unique guid
- kxrm 5y agoYep, and Mailgun requires a domain as well, they just don't do anything with it for filtering this behavior.
- Asmod4n 5y agoHm, strato, 1and1 and t-online only have one mx and spf record for all customers. Allowing you to send as anyone they have in their system and make it look authentic.
- pbhjpbhj 5y agoSurely they can cut off emails before it reaches the SMTP server though? Don't they have a milter that drops email sent by accounts that don't have the domain registered? They don't really forward spoofed mail do they??
- Asmod4n 5y agoThey do, they only check if you are allowed to log in. Exchange even has a feature built in for exactly this, their send connectors can’t store more than one account.
- jrodom 5y agoJosh CTO of Mailgun here - In this example, there is no actual sharing of domain reputation with other customers. Most inbox providers base reputation on the DKIM domain, which in this case is "sandbox.mgsend.net" not the header from address. Each message is uniquely signed by the sending domain belonging to the account owner, meaning that the domain reputation cannot be borrowed/shared between customers.