4 ms·
Fastmail [updated: allowed] customers to spoof email as From: other customers, unless you manage your custom domain's DNS DMARC p=reject. This is a social engin
by password4321 4y ago
Fastmail [updated: allowed] customers to spoof email as From: other customers, unless you manage your custom domain's DNS DMARC p=reject. This is a social engineer's dream come true!
https://news.ycombinator.com/item?id=18996200#18997054 https://news.ycombinator.com/item?id=18996200#18997054 (2019)
https://fastmail.blog/advanced/spf-dkim-dmarc https://fastmail.blog/advanced/spf-dkim-dmarc (2016)
- nmjenkins 4y agoThis has not been true for some time. You must verify you can receive email at an address before we allow you to send with it from Fastmail.
- password4321 4y agoGlad to hear this! It seems some content should be updated then? https://www.fastmail.com/about/bugbounty https://www.fastmail.com/about/bugbounty > We are quite aware that users can set arbitrary From addresses on emails, that our SPF records allow arbitrary hosts to send email as our domains, and that our DMARC policy is not enforcing passes. These policy decisions are by design, and we track the actual sender in a separate header. https://www.fastmail.help/hc/en-us/articles/1500000280461 https://www.fastmail.help/hc/en-us/articles/1500000280461 (not as clear here) > Fastmail domains have a DMARC policy of none