Ensure security for DMARC report generation
Abierto
mta-in
mta-out
security
- Lenguaje dominante
- Go
- Estrellas
- 6.1k
- Forks
- 327
- Métricas de merge de PR
- Sin PR fusionados en 30 d
Descripción
Follow-up for #206.
Sophisticated attacks based on ability to modify DNS records related to DMARC as observed by receiving server (MitM, cache poisoning, etc) can be used to disclose contents of messages otherwise protected by TLS.
- Report generation is disabled if zone containing DMARC record or "report receiver" record is not DNSSEC-signed.
- If message that caused report to be generated is delivered over TLS then report itself must be delivered over TLS. MX record authentication (via MTA-STS or DNSSEC) is required for report recipient as TLS is insecure without it.
Guía de contribución
Evaluación
Este issue todavía no se ha evaluado.