SPF Shadowing: Give old services a chance to shine

Caleb Crable opens with a short primer on Sender Policy Framework, the DNS text record that tells receiving mail servers which hosts may send mail for a domain. He argues that it is widely left unconfigured, or set to permissive qualifiers such as soft fail or neutral, which weakens the DMARC and DKIM checks that depend on it. He suggests that a fail-all policy, or a null record on domains that never send mail, should be the default.

The middle of the talk turns to what red teams can exploit. Caleb looks past root domains to the many subdomains that vendors assign to customers, such as login pages, and notes that many have no SPF record at all. He describes finding email infrastructure with permissive records, and a test in which a message was delivered under another company's sending service rather than the intended host. He also presents a small script he is building to query public data sources for domains with weak or missing SPF records, and shows it running with mixed results.

For practitioners, the takeaway is to audit SPF on every hostname and subdomain, including those tied to third-party vendors, and to test before sending. Caleb recommends reporting weak SPF records as findings in penetration tests. He notes that he disclosed one vendor's issue about three months before the talk and that it still had not been fixed when he last checked.