2

I'm wondering the following, what if shared SPF records like below are used?

v=spf1 include:_spf.google.com ~all
v=spf1 include:spf.mandrillapp.com ~all
v=spf1 include:servers.mcsv.net ~all

Can it affect the integrity of my domain?

Lets say I own secret.com and setup Mandrill, Google, Mailchimp or similair shared SPF records. Can my competitor bypass this security meassure by sending e-mails from competitor.com using my domain secret.com?

I assume that this way the SPF records check, will show that the domain competitor.com is allowed to send mails from my secret.com domain right? Or can the use of such shared SPF domains like above cause other risks?

Improve this question

1 Answer 1

Reset to default
4

Can my competitor bypass this security meassure by sending e-mails from competitor.com using my domain secret.com?

Yes, competitor can bypass this, but not easily. Lets say that SPF is

"v=spf1 include:spf.mandrillapp.com ~all"

This means that I allow server spf.mandrillapp.com to send emails for my domain, while all other will SoftFail (that is the ~all).

So back to the question, competitor would have to use the spf.mandrillapp.com to send emails using your domain. This is standing on one big BUT: but the competitor would have to have access to this server. So your mail is secure until your mail hoster does not give access to send mails as your domain form this server to competitor.

I assume that this way the SPF records check, will show that the domain competitor.com is allowed to send mails from my secret.com domain right?

No! This gives permisson to spf.mandrillapp.com, and others will SoftFail. You can read more about SPF records on Wikipedia.

Or can the use of such shared SPF domains like above cause other risks?

Your mail is secure until your mail hoster does not give access to send mails as your domain form this server to competitor.

Improve this answer
2
  • So basically i'm depending on mandrillapp in this case? If they allow me to use multiple domains without proper verification of domain ownership. I'm screwed and another mandrill user can misuse my domain and the SPF check will succeed since me and my competitor use the same SPF domain, right?
    – Bob Ortiz
    Commented Jul 1, 2015 at 20:46
  • 2
    Yes, you depend on Mandrillapp. Yes, if they do no verification, it is insecure.
    – Vilican
    Commented Jul 1, 2015 at 20:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .