Read on Twitter
Hey @SendGrid
1. Why do you allow a customer to place a different customer& #39;s domain in the mail& #39;s From header?
and/or
2. Why do you share DKIM keys between customers? If you used differing ones, DKIM verification would have failed here https://twitter.com/glenmaddern/status/1278333730977918976">https://twitter.com/glenmadde...
1. Why do you allow a customer to place a different customer& #39;s domain in the mail& #39;s From header?
and/or
2. Why do you share DKIM keys between customers? If you used differing ones, DKIM verification would have failed here https://twitter.com/glenmaddern/status/1278333730977918976">https://twitter.com/glenmadde...
We saw fraudsters doing the same thing a little while ago at @monzo. We turned on strict DMARC to fix it; GitHub should do the same; it protects against other types of attack
But realistically Sendgrid are being negligent here in not preventing these sorts of cross customer attacks
They& #39;re in a privileged position as an SPF/DKIM permitted sender for people& #39;s domains; they should be doing better for their customers
They& #39;re in a privileged position as an SPF/DKIM permitted sender for people& #39;s domains; they should be doing better for their customers
(I& #39;m not aware of if either Mailgun or Amazon SES allow these sorts of things to take place; Sendgrid are at fault here)
