7. Missing DMARC Enforcement and SPF Softfail Permit Email Spoofing
4.3
- CWE
- CWE-290 · Authentication Bypass by Spoofing
- CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N- Root cause
- The web.app domain publishes DNS records that, in combination, allow any external party to send email with a From: address claiming to be from web.app and have those messages delivered to recipient mailboxes without being rejected. The SPF record at the apex ends in ~all, the softfail mechanism, which instructs receiving mail servers to treat unauthenticated senders as suspicious but to accept and deliver them anyway. The DMARC policy published at _dmarc.web.app is v=DMARC1; p=none; with no rua= aggregate-reporting endpoint and no ruf= failure-reporting endpoint.
- Affected
DNS TXT record on "web.app" (SPF)DNS TXT record on "_dmarc.web.app"
- Remediation
- 1.Publish DMARC aggregate reports. Replace the _dmarc.web.app TXT record with: v=DMARC1; p=none; rua=mailto:dmarc-reports@web.app
- 2.Change the trailing ~all in the web.app SPF record to -all
- 3.Escalate the DMARC policy: p=quarantine; pct=25 then p=reject; pct=100