Fastmail [updated: allowed] customers to spoof email as From: other customers, unless you manage your custom domain's DNS DMARC p=reject. This is a social engineer's dream come true!
https://news.ycombinator.com/item?id=18996200#18997054 (2019)
https://news.ycombinator.com/item?id=18996200#18997054 (2019)
https://www.fastmail.com/about/bugbounty
> We are quite aware that users can set arbitrary From addresses on emails, that our SPF records allow arbitrary hosts to send email as our domains, and that our DMARC policy is not enforcing passes. These policy decisions are by design, and we track the actual sender in a separate header.
https://www.fastmail.help/hc/en-us/articles/1500000280461 (not as clear here)
> Fastmail domains have a DMARC policy of none