3 ms·
How did they send an email from google.com that passed DKIM and SPF? Thats a huge concern.
by adrr 2y ago
How did they send an email from google.com that passed DKIM and SPF? Thats a huge concern.
- jorams 2y agoIt's specifically a password reset email. A Google Workspace admin can send a password reset to any of their users, and it will pass DKIM and SPF. The trick here is that apparently you can sign up for Workspace with a g.co subdomain and, without verifying the domain, can trigger a password reset to be sent.
- layman51 2y agoI’m still a bit confused around how they sent him the email. Maybe they added him to the Google Workspace as a member?
- jorams 2y agoYeah they did. They added his email as a secondary email to a Google Workspace user account, with the plus-address-suffix including a "Case ID". Then they reset the password of the user account, triggering this notification.