Hacker News Reader

Comment by kxrm | Hacker News Reader

True, but do you just allow them to borrow the reputation of your other customers? If a scammer knows example.com is a customer (DNS records will tell me this quickly) and a scammer decides to open an account and send as example.com through the service. Does Mailgun have no responsibility or ability to stop this behavior?

Seems easy enough to stop from what I know of email. Otherwise DKIM and SPF are worth nothing in systems like this.

View on HN

Mailjet stops this by simply requiring domains to be registered to accounts before an account can send from that domain. Registering a domain requires adding a DNS record or file on that domain with a random unique guid

Yep, and Mailgun requires a domain as well, they just don't do anything with it for filtering this behavior.

Josh CTO of Mailgun here - In this example, there is no actual sharing of domain reputation with other customers. Most inbox providers base reputation on the DKIM domain, which in this case is "sandbox.mgsend.net" not the header from address.

Each message is uniquely signed by the sending domain belonging to the account owner, meaning that the domain reputation cannot be borrowed/shared between customers.

Hm, strato, 1and1 and t-online only have one mx and spf record for all customers. Allowing you to send as anyone they have in their system and make it look authentic.

Surely they can cut off emails before it reaches the SMTP server though? Don't they have a milter that drops email sent by accounts that don't have the domain registered? They don't really forward spoofed mail do they??

They do, they only check if you are allowed to log in.

Exchange even has a feature built in for exactly this, their send connectors can’t store more than one account.

Reply on news.ycombinator.com