2 ms·

This was a recent problem with Cloudflares partnership with MailChannels[1] that allowed email spoofing which was related to this. The basic problem being that

by pests 3y ago

This was a recent problem with Cloudflares partnership with MailChannels[1] that allowed email spoofing which was related to this. The basic problem being that mailchannel did not require authentication - cloudflare workers could just hit an API endpoint on mailchannel to send email. Mailchannel required you to add an include: record to your SPF policy. This allowed anyone to impersonate anyone else due to mailchannel being a valid sender for all domains. Only ~400 domains of the 2M hosted had DKIM set up but even if they did the passing SPF caused DMARC to pass. [1] https://blog.cloudflare.com/sending-email-from-workers-with-mailchannels/ https://blog.cloudflare.com/sending-email-from-workers-with-...

bawolff 3y ago
I mean i dont think requiring dkim would stop attacks based on totally broken authentication. In that scenario, mailchimp might as well be signing the emails for the incorrect domain as well.
- pests 3y ago
  True. MailChannels, not MailChip though. They handle email for a lot of webhosting providers.
ttul 3y ago
Appreciate the skepticism; it keeps us on our toes. Let's cut to the chase: Domain Lockdown: We added this to our Cloudflare Workers integration. It mandates a DNS TXT record to authorize a Worker to send emails from a specific domain. You can't forge the CF-Worker header, so impersonation is off the table. Pre-Lockdown Vulnerability: Yes, we were more exposed before. Thanks to the researchers who pointed it out, we've patched this up with Domain Lockdown. SMTP Relay & Web Hosting: Domain Lockdown isn’t mandatory yet in the rest of our service for the web hosting industry. But we’re developing updates for our cPanel WHM plugin and other integrations to make this scalable for millions of domains. Note that our service has to work for applications like public mailing lists where locking the sender domain down breaks stuff. Scale & Standardization: We service a broad range of configurations. Rolling out universal changes takes time. We're also working with industry groups like M3AAWG to push for improvements to DMARC and other standards to help everyone be more secure. Tech docs for the curious: https://support.mailchannels.com/hc/en-us/articles/456589835 https://support.mailchannels.com/hc/en-us/articles/456589835... Appreciate all the questions and criticism here. reply
- pests 3y ago
  Thank you for the transparency and the update. I didn't mean anything negative towards MailChannels - I know this is a weak link in the chain for many people. I did know it was resolved and I should have mentioned that but I couldn't figure out the search query to find that post.
  - ttul 3y ago
    No worries. My initial response was horrible; trying to do better.

by pests 3y ago

bawolff 3y ago

I mean i dont think requiring dkim would stop attacks based on totally broken authentication. In that scenario, mailchimp might as well be signing the emails for the incorrect domain as well.

pests 3y ago
True. MailChannels, not MailChip though. They handle email for a lot of webhosting providers.

ttul 3y ago

Appreciate the skepticism; it keeps us on our toes. Let's cut to the chase: Domain Lockdown: We added this to our Cloudflare Workers integration. It mandates a DNS TXT record to authorize a Worker to send emails from a specific domain. You can't forge the CF-Worker header, so impersonation is off the table. Pre-Lockdown Vulnerability: Yes, we were more exposed before. Thanks to the researchers who pointed it out, we've patched this up with Domain Lockdown. SMTP Relay & Web Hosting: Domain Lockdown isn’t mandatory yet in the rest of our service for the web hosting industry. But we’re developing updates for our cPanel WHM plugin and other integrations to make this scalable for millions of domains. Note that our service has to work for applications like public mailing lists where locking the sender domain down breaks stuff. Scale & Standardization: We service a broad range of configurations. Rolling out universal changes takes time. We're also working with industry groups like M3AAWG to push for improvements to DMARC and other standards to help everyone be more secure. Tech docs for the curious: https://support.mailchannels.com/hc/en-us/articles/456589835 https://support.mailchannels.com/hc/en-us/articles/456589835... Appreciate all the questions and criticism here. reply

pests 3y ago
Thank you for the transparency and the update. I didn't mean anything negative towards MailChannels - I know this is a weak link in the chain for many people. I did know it was resolved and I should have mentioned that but I couldn't figure out the search query to find that post.
- ttul 3y ago
  No worries. My initial response was horrible; trying to do better.