4 ms·
My admittedly limited experience with being on the other side of this amounts to receiving a number of reports about email-related DNS records accompanied by bo
by kbolino 2y ago
My admittedly limited experience with being on the other side of this amounts to receiving a number of reports about email-related DNS records accompanied by bounty requests. I realize there are different kinds of people out there, and reporting of more serious issues would warrant more respect, but it seems like a number of people are just fishing for attention/money/"experience". I really didn't need to be notified by randos that the DMARC policy I chose was "vulnerable". Thank you, I read the RFC already. If and when we do decide to change it, it's up to us and our security posture to decide, not you.
- stevekemp 2y agoIt is almost nice to see I'm not alone in those, I've had some incredibly aggressive contacts from "security researchers" reporting about lack of SPF/DKIM records on personal, and throwaway, domains. It's the same stuff that used to happen ten years ago regarding "clickjacking", and the lack of X-Frame-Options headers apparently meant the sky was falling, even though my SSL-protected site didn't host user-details, session-details, payment details, or anything other than static brochure content.