Stack Exchange network consists of 183 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.
This answer is incorrect, because the vulnerability does not affect all versions of Windows (in particular, the recently patched versions should not be at risk). Furthermore, this answer does not answer the question, because it doesn't address what conditions need to be present in addition to having a vulnerable Windows version connected to the internet, e.g. does the attacker require a Windows account or a privileged network position.
@SteffenUllrich When you refer to "claimed sender", you mean the domain in the "FROM" field, right? And the article I linked in OP is making the claim that nowadays servers in practice do not check the "FROM" field to verify sender, but instead check the "RETURN-PATH" field to verify sender, which doesn't really make sense to me.
Yes, I expect mail providers to use SPF for something it is not designed for in the first place: as one more input to their spam filtering systems. Perhaps I should have started by explaining my motivation: I'm looking into email deliverability issues. I'm now testing Postmark, and I'm getting pretty good deliverability. A few small ISPs are dropping my mail, and one is placing it into spam. I'm wondering if these issues are caused by my SPF record, which is not designating Postmark as an eligible sender. FYI I am providing DMARC as well.
