sublime-security/emailrep.io

Spoofable / DMARC not enforced

hazcod opened this issue · 6 comments

hazcod commented

Hi!

Just generally wondering why my domain ironpeak.be (e.g. hello@ironpeak.be) is marked as:

  • DMARC not enforced
  • Spoofable

While I have following TXT records:

  • _dmarc.ironpeak.be v=DMARC1; p=reject; rua=mailto:hello@ironpeak.be
  • v=spf1 include:_spf.google.com ~all

Command:

# curl emailrep.io/hello@ironpeak.be
{
  "email": "hello@ironpeak.be",
  "reputation": "low",
  "suspicious": false,
  "references": 1,
  "details": {
    "blacklisted": false,
    "malicious_activity": false,
    "malicious_activity_recent": false,
    "credentials_leaked": false,
    "credentials_leaked_recent": false,
    "data_breach": false,
    "first_seen": "never",
    "last_seen": "never",
    "domain_exists": true,
    "domain_reputation": "low",
    "new_domain": false,
    "days_since_domain_creation": 1498,
    "suspicious_tld": false,
    "spam": false,
    "free_provider": false,
    "disposable": false,
    "deliverable": true,
    "accept_all": false,
    "valid_mx": true,
    "primary_mx": "aspmx.l.google.com",
    "spoofable": true,
    "spf_strict": true,
    "dmarc_enforced": false,
    "profiles": [
      "gravatar"
    ]
  }
jkamdjou commented

ping @jkamdjou

apologies for the delay! thanks for the ping, will take a look at this today.

hazcod commented

Suddenly turned around 🤔 I do wonder why deliverable is false tough?

# curl emailrep.io/hello@ironpeak.be
{
  "email": "hello@ironpeak.be",
  "reputation": "low",
  "suspicious": false,
  "references": 1,
  "details": {
    "blacklisted": false,
    "malicious_activity": false,
    "malicious_activity_recent": false,
    "credentials_leaked": false,
    "credentials_leaked_recent": false,
    "data_breach": false,
    "first_seen": "never",
    "last_seen": "never",
    "domain_exists": true,
    "domain_reputation": "low",
    "new_domain": false,
    "days_since_domain_creation": 1519,
    "suspicious_tld": false,
    "spam": false,
    "free_provider": false,
    "disposable": false,
    "deliverable": true,
    "accept_all": false,
    "valid_mx": true,
    "primary_mx": "aspmx.l.google.com",
    "spoofable": false,
    "spf_strict": true,
    "dmarc_enforced": true,
    "profiles": [
      "gravatar"
    ]
  }
jkamdjou commented

Suddenly turned around 🤔 I do wonder why deliverable is false tough?

# curl emailrep.io/hello@ironpeak.be
{
  "email": "hello@ironpeak.be",
  "reputation": "low",
  "suspicious": false,
  "references": 1,
  "details": {
    "blacklisted": false,
    "malicious_activity": false,
    "malicious_activity_recent": false,
    "credentials_leaked": false,
    "credentials_leaked_recent": false,
    "data_breach": false,
    "first_seen": "never",
    "last_seen": "never",
    "domain_exists": true,
    "domain_reputation": "low",
    "new_domain": false,
    "days_since_domain_creation": 1519,
    "suspicious_tld": false,
    "spam": false,
    "free_provider": false,
    "disposable": false,
    "deliverable": true,
    "accept_all": false,
    "valid_mx": true,
    "primary_mx": "aspmx.l.google.com",
    "spoofable": false,
    "spf_strict": true,
    "dmarc_enforced": true,
    "profiles": [
      "gravatar"
    ]
  }

we've been having an issue with an upstream provider recently, will see what's going on here

jkamdjou commented

oh wait - deliverable is true in this snippet? were you maybe looking at disposable?

hazcod commented

@jkamdjou my bad, I guess you guys pushed some fixes to fix the spoofable.