Mailgun: Public Security Disclosure 16 by throwaway2346mg | 1 comments on Hacker News. TLDR: Inbound email routes don't have SPF/DKIM/DMARC protection, meaning any inbound email sent to a webhook can be trivially spoofed / phished. Mailgun describe inbound routes as: "complex incoming messages are simplified and parsed into all of the data you need with Inbound Routes." [1] Mailgun refers to DKIM/SPF/DMARC with: "Mailgun leads the charge in email authentication by requiring DKIM and SPF records by default before you can begin sending." [2] However, nowhere does it say that Mailgun does not provide SPF or DKIM validation checks on inbound emails. Confusingly, these headers appear only for a subset of inbound emails. Attack scenario: 1) Pick any domain using mailgun for inbound email processing (trivially found via MX records). 2) Spoof an email from any address you want to impersonate (eg. security@mailgun.com). If that address is handled via an inbound route ...