Paragon Initiative Enterprises · Report #130990
Vunerability : spf
Summary
We've had several people report "you don't have SPF records in your website". This is troubling for several reasons:
- Our scope is specifically limited to only our Github projects.
- We have interstitials set up to remind folks, "Our website isn't in scope."
- Where our identity matters, we sign messages with GnuPG. Relying on SPF headers is a great way to convince yourself that DNSSEC is just fine.
How it was found
Heĺlo sir, im an independent security researcher. I found an vunerability in your website Your website https://github.com/paragonie doesn't have valid spf records. To recover this do validate your spf. Sender Policy Framework (SPF): This allows you specify which mail servers are allowed to send mails for your domain. There is of course nothing to stop a spammer sending a mail from their mail server for your domain, but e-mail clients can then check the SPF policy for your site, see it's not on the approved list and then choose to either ignore the mail completely, or at least mark it as likely spam. For more details https://en.m.wikipedia.org/wiki/Sender_Policy_Framework Regards, Neeraj