Read on Twitter
Hey @SendGrid
1. Why do you allow a customer to place a different customer's domain in the mail's From header?
and/or
2. Why do you share DKIM keys between customers? If you used differing ones, DKIM verification would have failed here https://twitter.com/glenmaddern/status/1278333730977918976
1. Why do you allow a customer to place a different customer's domain in the mail's From header?
and/or
2. Why do you share DKIM keys between customers? If you used differing ones, DKIM verification would have failed here https://twitter.com/glenmaddern/status/1278333730977918976
We saw fraudsters doing the same thing a little while ago at @monzo. We turned on strict DMARC to fix it; GitHub should do the same; it protects against other types of attack
But realistically Sendgrid are being negligent here in not preventing these sorts of cross customer attacks
They're in a privileged position as an SPF/DKIM permitted sender for people's domains; they should be doing better for their customers
They're in a privileged position as an SPF/DKIM permitted sender for people's domains; they should be doing better for their customers
(I'm not aware of if either Mailgun or Amazon SES allow these sorts of things to take place; Sendgrid are at fault here)
