GSA Bounty · Report #263733
Email Spoofing - SPF record set to Neutral
Summary
Some of our domains lack SPF and/or DMARC records. While this is something we improve where we can, it's a known issue, and quite low risk. So, we don't consider lack of SPF/DMARC on these domains to be valid security issues.
How it was found
Hi,
Introduction: There is a email spoofing vulnerability.Email spoofing is the forgery of an email header so that the message appears to have originated from someone or somewhere other than the actual source. Email spoofing is a tactic used in phishing and spam campaigns because people are more likely to open an email when they think it has been sent by a legitimate source. The goal of email spoofing is to get recipients to open, and possibly even respond to, a solicitation.
Steps to Reproduce:
- goto http://www.kitterman.com/spf/validate.html
- Enter domain name: 18f.com and click spf record if any under "Does my domain already have an SPF record? What is it? Is it valid?"
- The SPF record is observed as below "Found v=spf1 record for 18f.gov: v=spf1 include:spf.mandrillapp.com ?all"
which is set to neutral,Neutral-The SPF record specifies explicitly that nothing can be said about validity.