Upwork公司违反了其自身的DMARC和SPF策略。
2 分•作者: tmcdos•4 个月前
我不确定这个问题是发生在所有发件邮件上，还是只发生在部分邮件上。Upwork.com 的 SPF 策略规定，允许 mail.clinchtalent.com 和 spf.mandrillapp.com 列出的所有 IP 地址代表 upwork.com 发送邮件。
然而，至少部分（如果不是全部）由 Upwork 市场生成的系统邮件都是通过 MailGun 发送的，而它们的 IP 地址并未包含在 upwork.com 的 SPF 策略中。
此外，upwork.com 的 DMARC 策略被设置为“严格”模式——这意味着如果 SPF 检查失败，所有符合 RFC 规范的 SMTP 服务器都应该拒绝该邮件。
我提交了一个支持工单，并清楚地解释了情况。支持人员承认他没有接受过这方面的培训，也不理解我解释中过于技术性的部分（包括截图和日志）——所以我自然而然地要求将问题升级给更有资质的人员。
不出所料，我的请求被忽略了，我们继续来回沟通。我试图解释这种 DNS 配置错误对 Upwork 公司造成的安全性和邮件送达率影响——但我的话再次被忽略了。
另一位支持人员介入（可能是换班了），我们又回到了第一步——这种情况比和 AI 聊天要好，但如果缺乏资质的员工拒绝将问题转交给他们更有资质的同事，情况似乎也好不到哪里去。
我可以理解工程师们不想被琐事打扰。但当一线支持人员不理解我在说什么，而且我们已经交换了十几条消息，而一个中级工程师在第一步就能解决问题时——所有后果首先会影响到公司，然后是它的客户。
查看原文
I am not sure whether it happens on all outgoing emails or only on some of them. The SPF policy for upwork.com specifies that mail.clinchtalent.com and all IP addresses that are listed by spf.mandrillapp.com are allowed to send email on behalf of upwork.com<p>However, at least some (if not all) of the system emails that are generated and sent by the Upwork marketplace go through MailGun - and their IP addresses are missing from the SPF policy for upwork.com
Additionally, the DMARC policy for upwork.com is set to "strict" - which means that if the SPF check fails then all RFC-compliant SMTP servers should reject the message.<p>I raised a support ticket and clearly explained the situation. The support agent admitted that he is not trained on such things and does not understand the overly technical part of my explanations (including screenshots and logs) - so I naturally asked for escalation to someone who is more qualified.<p>Quite expectedly, my request was ignored and we continued our conversation back and forth. I tried to explain the security and deliverability implications of such DNS misconfiguration for the Upwork company - and my words were again ignored.<p>Another support agent stepped-in (perhaps another shift) and we are back on step 1 - the situation is better than chatting with an AI but apparently not so much if unqualified staff refuses to transfer the ball to their more qualified colleagues.<p>I can understand that engineers do not want to be bothered with trivial things. But when the first line of support does not understand what I am talking about and we are exchanging a dozen of messages while a mid-level engineer would have got the thing already on step 1 - all the consequences go to the company first and then on its customers.