4 ms·
Look I get it on a technical level. But we've just had years of being yelled for anything but a hard fail. It's become a meme that anyone with a bug bounty prog
by technion 4y ago
Look I get it on a technical level. But we've just had years of being yelled for anything but a hard fail. It's become a meme that anyone with a bug bounty program and softfail can expect to have it come in as a "vulnerability" no matter how out of scope you make it.
It's valid to question and change strategies, but I don't think it's a good approach that people who've been chastised for years for softfails are suddenly being chasisted for hard fails.
Edit:
Note that users signing up to Office 365 are told to use hardfail: https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/email-authentication-spf-configure?view=o365-worldwide https://learn.microsoft.com/en-us/microsoft-365/security/off...
- LeonM 4y agoMS can't expect all their users to use DMARC, and blatantly advising their customers to do so can be dangerous. Not every domain is ready for DMARC and enabling it would cause undeliverable email. It wouldn't surprise me if MS was being harassed by angry 'experts' for not recommending 'hard' fail, because clearly that would be so much more secure (just look al all the comments in this topic). So I get it, advising to use a strict failure mode, even at the expense of some undeliverable email is acceptable for MS. But for those who have already adopted DMARC, the SPF 'hard' fail only increases the chance of undeliverable mail, while offering zero security benefits.