Subject: Ticket Assigned - Re: SECURITY BUG REPORT [ lifestyleshops.com DMARC RECORD MISSING ]
From: Lifestyle <[email-masked]>
To: [email-masked]
Date: Sun, 22 Nov 2020 11:56:04 +0000

Hi Abdulqader Mohd. Ahmed,  A new ticket has been assigned to you. Please follow the link below to view the ticket.  Re: SECURITY BUG REPORT [ lifestyleshops.com DMARC RECORD MISSING ] *Hi, Please give update otherwise I will disclose to public*

On Fri, Oct 2, 2020 at 2:27 PM [email-masked] <
[email-masked]> wrote:

> Hello, I am Abhishek Karle and I found one security vulnerability on your
> domain , If it is eligible for monetary reward then My paypal email -
> [email-masked] send reward over here.
> VULNERABILITY Name- DMARC RECORD Missing.
>
> Bug Target- lifestyleshops.com
>
> Description :
>
> Spammers can forge the "From" address on email messages to make messages
> appear to come from someone in your domain. If spammers use your domain to
> send spam or junk email, your domain quality is negatively affected. People
> who get the forged emails can mark them as spam or junk, which can impact
> authentic messages sent from your domain.
>
> Steps To reproduce -
>
> 1. GO TO- https://mxtoolbox.com
> 2. ENTER THE Domain ( lifestyleshops.com ) > CLICK GO.
> 3. YOU WILL SEE THE FAULT(No DMARC Record found)
> 4. In the new page that loads change MXLookup to DMARCLookup
>
>
> Impact:-
>
> Spammers can forge the "From" address on email messages to make messages
> appear to come from someone in your domain.
> If spammers use your domain to send spam or junk email,
> your domain quality is negatively affected. People who get the forged
> emails can mark them as spam or junk,
> which can impact authentic messages sent from your domain.
>
> Mitigation -
>
> This are some links for tpublishing DMARC record for your domain please
> look on this :
>
> 1)
> https://help.returnpath.com/hc/en-us/articles/222480908-How-to-set-up-a-DMARC-record
>
> 2)
> https://www.dmarcanalyzer.com/dmarc/dmarc-record-setup-guides/dmarc-setup-guide-godaddy/
>
> 3)https://www.a2hosting.in/kb/cpanel/cpanel-mail-features/dmarc
>
> Another solutin for DMARC record are as follows:
>
> 4)https://support.google.com/a/answer/2466563?hl=en
>
> It depends on what you want to achieve. There are 2 possible cases
>
> To fix the issue, a DMARC record containing p=reject; should be added,
> which will cause spoofed emails to be rejected by the recipients mailbox.
>
> Case 1 Simply get rid of annoying No DMARC record message without
> understanding the real value of DMARC and any email spoofing protection
>
> The answer is very simple. Technically fixing No DMARC record found
> literally means adding a TXT DNS record in _dmarc.yourdomain.com
> subdomain according to DMARC specification. The basic DMARC record can be
> as simple as the following
>
> v=DMARC1; p=none; rua=mailto:[email-masked]
>
> You are done. You have successfully added your missing DMARC record.
>
> Congratulations, but with that record you are very far way to stop email
> spoofing and impersonation attacks.
>
> Case 2: Get 100% protection against email impersonation and spoofing
> attacks
>
> To achieve 100 percent protection you need to understand mechanics behind
> the DMARC system and how it works. Its hard to achieve 100% protection
> against email spoofing and it requires diligence and some time more than 2
> months usually and depends on how complex is your email infrastructure is.
> It is hard because if your configuration is not correct, not only fake
> emails send by hackers from your domain but also your valid emails can be
> rejected either. Its like a having protected folder where nobody can access
> and even you cant access it the folder is very secure, but it is useless if
> even I cant access it Our platform EasyDMARC is an easy solution for people
> like you to avoid risks and safely achieve 100 percent protection on hard
> journey of DMARC deployment
>
> The journey start with simply putting basic DMARC record.
>

 https://landmarkgroupservice.freshdesk.com/helpdesk/tickets/1732679