Re: misconception in SPF

here is the proof of concept ! an email sent to John Levine claiming
to be from [email protected] !!!

Could you please John paste the Received-SPF checks of your mailserver ?


Connected to mail1.iecc.com.
Escape character is '^]'.
220 mail1.iecc.com mailfront ESMTP
EHLO www.johnlevine.com
250-mail1.iecc.com
250-SIZE 0
250-8BITMIME
250-ENHANCEDSTATUSCODES
250 PIPELINING
MAIL FROM: [email protected]
250 2.1.0 Sender accepted.
RCPT TO: [email protected]
250 2.1.5 Recipient accepted.
DATA
354 End your message with a period on a line by itself.
From: [email protected]
To: [email protected]
Subject: p o c

Hi John, just a proof of concept
.
250 2.6.0 Accepted message qp 34000 bytes 540
quit
221 2.0.0 Good bye.
Connection closed by foreign host.



2012/12/6 Christian Grunfeld <[email protected]>:
> Hi,
>
> Something I found about SPF. I don't know if it is new to you but it
> is worth of explanation !
>
> As in all the tutorials of SPF, one stays relaxed when lists hosts/ips
> that are authorized to send for the domain and then finally closes
> with -all. This is true only for that domain but if there are hosts or
> subdomains with A records, they must enforce SPF policies ! (this is
> not explicit in RFC or at least confusing).
>
> A single host or subdomain that don't do it can lead to a sender spoofing attack
> and pose as someone from our domain without the SPF to detect it.
>
> This is because when we receive mail from [email protected] the SPF
> protocol seeks TXT records corresponding to bar.mydomain instead of
> TXT record for mydomain. If there is an A record for bar.mydomain but
> no TXT "v=spf1 -all" for it, SPF returns "none" although SPF exists
> for mydomain !
>
> Thus an attacker can inject an email from everywhere claiming that is
> from [email protected] !
>
> As the default policy of SPF should not be "fail if not present" the
> solution is to enforce with the records TXT "v = spf1-all" for each A
> record that should not send emails!
> This also can be made by means of wildcards but it is discourage in the RFC.
>
> Cheers