I saw on my SMTP logs that it queried a possible phishing domain, I look up on its MX records and it didn't have one. Does the domain need an MX record before sending phishing emails?
3
-
I think this has your answer: security.stackexchange.com/questions/211755/…– schroeder ♦Commented Dec 12, 2019 at 14:59
-
1You can specify any domain as the sender, whether or not the domain exists or has an MX record.– schroeder ♦Commented Dec 12, 2019 at 15:00
-
3Does this answer your question? Spear phishing data set– user173641Commented Dec 12, 2019 at 15:18
Add a comment
|
1 Answer
Does the domain need an MX record before sending phishing emails?
No. According to RFC 2821, if there is no MX record, then mail delivery will look for an A record instead:
The lookup first attempts to locate an MX record associated
with the name. If a CNAME record is found instead, the
resulting name is processed as if it were the initial name.
If no MX records are found, but an A RR is found, the A RR
is treated as if it was associated with an implicit MX RR,
with a preference of 0, pointing to that host.
answered Dec 12, 2019 at 14:30
-
This is for the case where one would like to send an email back, provided that the return address is the same as the sender's. As for sending the original (spam) email, whatever domain as the source works (now, such emails may or may not reach the target depending on the configuration of the receiving MTA)– WoJCommented Dec 12, 2019 at 16:42
-
While the lack of an MX record is not technically required, the days of the internet wild west where anyone could stand up a server and send email is mostly gone because common practice is to refuse federated server transfers from email servers without an MX record in order to reduce abuse. Commented Dec 13, 2019 at 18:34