991715 - SPF Record not found for firefox.com

Status: RESOLVED INCOMPLETE

(Infrastructure & Operations :: Infrastructure: Mail, task)

Description

[nitingoplani88]

Attachment: SPF Record not found.jpg

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0 (Beta/Release)
Build ID: 20140314220517

Steps to reproduce:

Check for PSF Entry


Actual results:

It was observed that there is no TXT record in DNS zone that defines Sender Policy Framework entry for India domain firefox.com && mozilla.org

This makes it easy to spoof your e-mail address


Expected results:

It must have SPF Record.

About SPF: Sender Policy Framework (SPF) is an email validation system designed to prevent email spam by detecting email spoofing, a common vulnerability, by verifying sender IP addresses. SPF allows administrators to specify which hosts are allowed to send mail from a given domain by creating a specific SPF record (or TXT record) in the Domain Name System (DNS). Mail exchangers use the DNS to check that mail from a given domain is being sent by a host sanctioned by that domain's administrators.

Comment 2

[nitingoplani88]

Hi,

Mozilla.org is duplicate but firefox.com is not duplicate. Could you please cross verify?

Comment 3

[nitingoplani88]

Waiting for your response? Could you please check for firefox.com

Comment 4

[:Atoll]

Altered this bug to focus on firefox.com.

SPF for mozilla.org is being tracked in bug 240169, and for firefox.com in bug 991715.

These are independent bugs as each domain has different use cases, and care must be taken to ensure that whatever SPF we eventually ship is compatible with how we use them.

Comment 5

[nitingoplani88]

Hi Richard,

Thanks for your update. Kindly let me know whenever you have further update on this issue.

Thanks

Comment 6

[nitingoplani88]

Hi,

Any update on this issue?

Comment 7

[:Atoll]

I'm marking this bug as INCOMPLETE for now. We have not chosen how to proceed, and I cannot provide any guidance on whether or not this will be completed soon. (We do understand the construction and purpose of SPF records.) If and when we choose to proceed, this bug will be reopened and updated with our progress and eventual SPF decisions.

Comment 8

[nitingoplani88]

Thanks for the update. Just wanted to know whether this is eligible for any bounty or not?

Comment 9

[nitingoplani88]

Yup is this eligible for security bounty?

Comment 10

[nitingoplani88]

Hi,

Actually am not sure whats going on? I received mails from bugzilla reagrding different ID for SPF Implementations. But for this domain firefox.com whats the problem I dont know

Comment 11

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

(In reply to nitingoplani88 from comment #9)
> Yup is this eligible for security bounty?

removing bounty flag, as this is not a bounty eligible bug