Viewing profile — throwaway2346mg

I don't think this is related. The issue here is with inbound emails using Mailgun's inbound routes functionality. Protecting your sending servers from abuse isn't an issue with Ma…

Yep - there are a number of scenarios: - CRM system (obviously an issue) - Inbound email automation (eg. action based on reply from user / admin / etc) But really, any inbound acti…

Exactly this!

As pointed out on Reddit [1], if you want to trivially see companies using Mailgun it's as simple as looking at: https://securitytrails.com/list/mx/mxb.mailgun.org https://security…

I'm afraid I haven't checked this - are you a Mailgun user and want to report back on this? Alternatively, hopefully Mailgun themselves will spot this and can respond directly.

> Is the problem that they don't do the verifications for SPF/DKIM/DMARC for inbound emails? Yes - the result of the checks aren't passed through for inbound emails (when sent to w…

Agreed. I think the point here is that what % of Mailgun users will be doing this additional processing? I suspect it's basically 0%. Why? It's not outlined in their specs, their s…

The sender can be anyone. They don't need to be a mailgun user. The recipient has to be a mailgun user, yes.

> Is that not identical to "if a company runs an SMTP server, you send a spoofed email, and they don't do any validation then phishing is trivial"? Yes. Except in this case, the co…

Yes - it's emails that hit a certain pre-determined spam assassin threshold (see Note B). But this is fairly easy to circumvent (spammers/phishers are especially good at it) and th…

TLDR: Inbound email routes don't have SPF/DKIM/DMARC protection, meaning any inbound email sent to a webhook can be trivially spoofed / phished. Mailgun describe inbound routes as:…

I'm not sure if this is relevant in regards to the security disclosure itself. If you're not using Mailgun then this doesn't affect you. However, with regards to "SPF is more than …

TLDR: Inbound email routes don't have SPF/DKIM/DMARC protection, meaning any inbound email sent to a webhook can be trivially spoofed / phished. Mailgun describe inbound routes as:…