The Sender Policy Framework (SPF) is an email-authentication technique which is used to prevent spammers from sending messages on behalf of your domain. With SPF an organisation can publish authorized mail servers.SPF record is published in the DNS (Domain Name Service) and it contains a list of authorized email servers . If an email sender isn’t listed in the record section and does send email on behalf of your domain this email may be considered as not legitimate and can be rejected by the email receiver
Lets have look into the vulnerability. We can see If the SPF record is not published in DNS the organization/Web Applications customers have a chance for Phishing attacks.
Lets see an example
Scam Email
There is an organization Fetlla Private Limited. One employee of Fetlla getting an email for changing the password. When the employee checking that email he get to know that the mail is from admin and he thinks it will be genuine and when he will click there is a chance for the Phishing or CSRF attacks. The attack methos is called spoofing.
Admin mail id and Organization name
Lets see the PoC of the Attack:
Step 1: Go to the https://www.kitterman.com/spf/validate.html or https://mxtoolbox.com/ and check for the SPF Record
Step 2: Check the SPF record
Insufficient SPF Record
Step 3: Go to https://emkei.cz/ and create a Spoof email by same as the Website or organization.
Spoof email creator Tool
Step 4: Send the mail and check it in for SPAM/Junk folder. If the mail is recieved to your email this is vulnerable.