Loading HuntDB...

There is any issue No valid SPF Records

None
K
Kubernetes
Submitted None

Team Summary

Official summary from Kubernetes

We have been aware of issues related to domain SPF and DMARC records since before the bug bounty program was launched (see [this email thread](https://groups.google.com/a/kubernetes.io/g/security/c/HgCx2lLamkU/m/ArxPiscqCAAJ)). While we may address the issue in the future, nobody in the community has judged it of sufficient importance to take the time to add/update the records.

Reported by blackviper21

Vulnerability Details

Technical details and impact analysis

Improper Authentication - Generic
There is a email spoofing vulnerability.Email spoofing is the forgery of an email header so that the message appears to have originated from someone or somewhere other than the actual source. Email spoofing is a tactic used in phishing and spam campaigns because people are more likely to open an email when they think it has been sent by a legitimate source. The goal of email spoofing is to get recipients to open, and possibly even respond to, a solicitation. I found : SPF record lookup and validation for: Kubernetes.io SPF records are published in DNS as TXT records. The TXT records found for your domain are: v=spf1 include:_spf.google.com ~all google-site-verification=oPORCoq9XU6CmaR7G_bV00CLmEz-wLGOL7SXpeEuTt8 Checking to see if there is a valid SPF record. Found v=spf1 record for Kubernetes.io: v=spf1 include:_spf.google.com ~all evaluating... SPF record passed validation test with pySPF (Python SPF library)! Use the back button on your browser to return to the SPF checking tool without clearing the form. Remediation : Replace ~all with -all to prevent fake email. Refferences : https://www.digitalocean.com/community/tutorials/how-to-use-an-spf-record-to-prevent-spoofing-improve-e-mail-reliability ## Impact An attacker would send a Fake email. The results can be more dangerous.

Report Details

Additional information and metadata

State

Closed

Substate

Duplicate

Submitted

Weakness

Improper Authentication - Generic