Considering how CloudFlare was just implicated in destroying secure email at Defcon [1], the addition of GPUs to that active assault is terrifying.
Since you cannot forge the CF-Worker header in API requests (this header is added by Cloudflare's back end), it is not possible to send email for any domain that hasn't been locked down to your specific Worker.
Domain Lockdown: We added this to our Cloudflare Workers integration. It mandates a DNS TXT record to authorize a Worker to send emails from a specific domain. You can't forge the CF-Worker header, so impersonation is off the table.
Pre-Lockdown Vulnerability: Yes, we were more exposed before. Thanks to the researchers who pointed it out, we've patched this up with Domain Lockdown.
SMTP Relay & Web Hosting: Domain Lockdown isn’t mandatory yet in the rest of our service for the web hosting industry. But we’re developing updates for our cPanel WHM plugin and other integrations to make this scalable for millions of domains.
Scale & Standardization: We service a broad range of configurations. Rolling out universal changes takes time. We're also working with industry groups like M3AAWG to push for improvements to DMARC and other standards to help everyone be more secure.
Tech docs for the curious: https://support.mailchannels.com/hc/en-us/articles/456589835...
Appreciate all the questions and criticism here.