HexBrain

WHO COVID-19 Mobile App · Report #1064087

DMARC and SPF records

Validstatus
mediumseverity
9upvotes
22 Dec 2020disclosed

How it was found

If you are encountering this error of No DMARC Record found, this means that your domain does not have a published DMARC record. DMARC Records are published via DNS as a text(TXT) record. They will let receiving servers know what they should do with non-aligned email received from your domain.

Vulnerable url: whocoronavirus.org

HOW TO REPRODUCE(POC-ATTACHED IMAGE):-

1.GO TO- https://mxtoolbox.com

2.ENTER THE WEBSITE CLICK GO.

3.YOU WILL SEE THE FAULT(No DMARC Record found)

4.In the new page that loads change MXLookup to DMARC Lookup

Impact

Spammers can forge the "From" address on email messages to make messages appear to come from someone in your domain. If spammers use your domain to send spam or junk email, your domain quality is negatively affected. People who get the forged emails can mark them as spam or junk, which can impact authentic messages sent from your domain

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original