Infogram · Report #280408
SPF Misconfiguration
Validstatus
lowseverity
4upvotes
6 Nov 2017disclosed
How it was found
I am just looking at your SPF records then found following. SPF Records missing safe check which can allow me to send mail on behalf of infogram.
#PoC: The TXT records found for your domain are:
"v=spf1 include:_spf.google.com include:spf.mandrillapp.com include:mailgun.org ~all"
Simply anyone can use https://emkei.cz/ service to trigger mail to anyone on behalf of infogram.
#Fix:
v=spf1 include:_spf.google.com include:spf.mandrillapp.com include:mailgun.org -all
#If team don't wanna hear about spf related checks please let me know. i'll close this report myself.
Regards, Mr.R3boot.