HexBrain

ThisData · Report #36459

Missing SPF header on revert.io

Validstatus
1upvotes
18 Jan 2015disclosed

How it was found

Hi,

I noticed that there is no TXT record containing a SPF header:

#PoC

> dig TXT revert.io +short
"google-site-verification=ix6OUwvbN9AJLTcdg3ulWcMibIWGgUy_zWEXrWeRYE4"

The SPF Header can be used to prevent phishers from impersonating you/your company in the emails' FROM header.

#Fix You can fix that by generating an SPF-TXT record with all your outgoing mailservers.

All the best, Sebastian

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original