Subject: Re: VULNERABILITY REPORT-DMARC RECORD MISSING
From: xtree ky <[email-masked]>
To: [email-masked]
Date: Fri, 24 Jan 2025 02:35:41 +0500

Dear,

I would like to offer my expertise in bolstering your website’s security. I
can identify potential vulnerabilities, provide evidence of these
weaknesses (proof-of-concepts), and suggest solutions to mitigate them.
This proactive approach can protect your website from malicious attacks.

To encourage responsible disclosure and ongoing security improvements, I
propose implementing a bug bounty program. This would reward security
researchers for identifying and reporting vulnerabilities.

Thank you for considering my offer.

On Tue, 6 Aug 2024 at 17:57, xtree ky <[email-masked]> wrote:

> It's been a long time since I last heard back from you.
> I hope that during this period you have seen the report and have taken
> preliminary precautions to mitigate this issue and if you still have not
> read the report I urge you to please discuss this with your internal team
> as this vulnerability can severely affected your website if proper actions
> are not taken as soon as possible.
> Hope to hear a positive reply from your side very soon
>
> Regards
>
> On Wed, 29 May 2024 at 08:14, xtree ky <[email-masked]> wrote:
>
>> Hi there team,
>>
>> It's been some time since I had send you the report.
>> Did you checked the report? and if yes please tell me what you have
>> decided as I have found more bugs.
>> Looking forward to hear from you soon
>>
>> Regards
>>
>> On Wed, 24 Jan 2024 at 09:15, xtree ky <[email-masked]> wrote:
>>
>>> Hi there team,
>>>
>>> Hope you are doing well.
>>> I have sent you a vulnerability report describing a bug that I have
>>> found on your website.
>>> Please check and reply at your earliest convenience.
>>> Regards
>>>
>>> On Tue, 26 Dec 2023 at 13:31, xtree ky <[email-masked]> wrote:
>>>
>>>> *What Is DMARC:*
>>>>
>>>> There is an email spoofing vulnerability.Email spoofing is the forgery
>>>> of an email header so that the message appears to have originated from
>>>> someone or somewhere other than the actual source. Email spoofing is a
>>>> tactic used in phishing and spam campaigns because people are more likely
>>>> to open an email when they think it has been sent by a legitimate source.
>>>> The goal of email spoofing is to get recipients to open, and possibly even
>>>> respond to, a solicitation.
>>>>
>>>> *How To Reproduce:*
>>>> 1.GO TO- https://mxtoolbox.com/
>>>> 2.ENTER THE WEBSITE (designerliving.com).CLICK GO.
>>>> 3.YOU WILL SEE THE FAULT (No DMARC Record found)
>>>> 4.In the new page that loads change MXLookup to DMARCLookup
>>>> POC-ATTACHED IMAGE
>>>>
>>>> *POC*
>>>> *Impact:*
>>>>
>>>> Spammers can forge the "From" address on email messages to make
>>>> messages appear to come from someone in your domain. If spammers use your
>>>> domain to send spam or junk email, your domain quality is negatively
>>>> affected. People who get the forged emails can mark them as spam or junk,
>>>> which can impact authentic messages sent from your domain.
>>>>
>>>> *Fix:*
>>>>
>>>> If you are having issues with DMARC, the fix will depend on the
>>>> specific problem you are facing. Here are it's fixes:
>>>>
>>>> *1-*DMARC policy is not being applied: If your DMARC policy is not
>>>> being applied, check that your DNS records are correctly configured with
>>>> the correct DMARC policy. Also, ensure that your email service provider
>>>> (ESP) is configured to enforce DMARC policies. If you are using a
>>>> third-party service for email authentication, make sure that it is
>>>> configured correctly.
>>>>
>>>> *2-*Emails are being incorrectly marked as spam: If your emails are
>>>> being marked as spam, it could be due to DMARC alignment issues. Ensure
>>>> that your SPF (Sender Policy Framework) and DKIM (DomainKeys Identified
>>>> Mail) records are correctly configured and aligned with your DMARC policy.
>>>>
>>>> *3-*DMARC reports are not being received: If you are not receiving
>>>> DMARC reports, ensure that your DMARC policy is correctly configured to
>>>> send reports to your preferred email address. Also, ensure that your email
>>>> service provider is configured to send DMARC reports.
>>>>
>>>> *4-*DMARC policy is too strict: If your DMARC policy is too strict,
>>>> legitimate emails may be rejected or marked as spam. You can adjust your
>>>> DMARC policy to be less strict, or whitelist legitimate senders.
>>>> Hoping to hear from you soon
>>>>
>>>> Best Regards,
>>>>
>>>>