1217545 - SPF Records are not enforced for some domains of Mozilla

Status: RESOLVED FIXED

(Infrastructure & Operations :: Infrastructure: Mail, task)

Description

[Shailesh Suthar]

User Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0
Build ID: 20150910171927

Steps to reproduce:

1. Use any technique of mail spoofing (online sites or own code).
2. Use any of following as senders and spoofed message: 

[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]

3. Victim will get email
4. Done


Actual results:

Hello, 

For some domains of mozilla, SPF records are not configured means SPF records are not found for following domains : 

oneanddone.mozilla.org
bugzilla.mozilla.org
getfirefox.com
addons.mozilla.org
services.addons.mozilla.org
versioncheck.addons.mozilla.org
pfs.mozilla.org
download.mozilla.org

Attacker can use any of above domains because there is no SPF records. You may not use any of above domains for mailing purpose but victim doesn't know about this and easily can be made fool.

Also , FOr main domain "mozilla.org" SPF Records are established but it's configured 
incorrectly. So attacker can use this main domain for spoofing purposes.

ex... [e-mail]

Current SPF Records : 

v=spf1 record for mozilla.org:
v=spf1 include:_spf.mozilla.com include:_spf.google.com ~all 

Recommended SPF records : 

v=spf1 record for mozilla.org:
v=spf1 include:_spf.mozilla.com include:_spf.google.com -all 

Replace ~(tilde) with (-)minus.


Expected results:

SPF Records should be configured properly for mentioned domains.

Comment 1

[Daniel Veditz [:dveditz]]

We have hundreds of hosts, and dozens of dupes/variations of this bug. Even though we obviously don't care about SPF all that much (not all recipients will check spf) we'd save ourselves a lot of hassle if we just made the policy not permissive.

Comment 3

[Shailesh Suthar]

@byron,

Kindly update status of this bug report.
Best,

Shailesh

Comment 4

[Daniel Veditz [:dveditz]]

This is one of the most commonly reported issue from Bug Bounty seekers. I'm unhiding this.

Comment 7

[Daniel Veditz [:dveditz]]

Actually, let's call this "FIXED". bug 240169 was about adding the SPF entries in the first place, but we did so in permissive mode because mozilla's distributed nature (including community projects and 3rd-party services) made it extremely hard to enforce. This has finally been enabled at the end of April 2024. I'd make this a duplicate of the actual work but I can't find it and it's likely now tracked in some internal-only JIRA ticket. If someone knows we could add that to the "See Also" field, although it wouldn't do any good for anyone but Mozilla employees.