0

One of the clients I work for has a test@xxxx.com account. I believe it's an alias, and I got an email signing up for a random site (it's a legit site) presumably to test that someone had access to it.

It had a confirmation link in it, and the same email ALSO got a 'confirmed' email from the same site. To me this suggests someone has successfully tested access to this email address. But how? What are some vectors people have? The company manages their own DNS service, and thus MX records. They point to google.

What are some things I can do to debug this? I've already went on to check our MX records at https://mxtoolbox.com/

And everything there is a google.com or googlemail.com hostname. When searching for problems here is what comes up:

dmarc   thedomain.com   DNS Record not found      More Info
mx  thedomain.com   No DMARC Record found     More Info
dns thedomain.com   Primary Name Server Not Listed At Parent      More Info
smtp    aspmx.l.google.com  Reverse DNS does not match SMTP Banner    More Info
smtp    alt1.aspmx.l.google.com Reverse DNS Resolution - No PTR Record found      More Info
smtp    alt2.aspmx.l.google.com Reverse DNS does not match SMTP Banner    More Info
smtp    aspmx2.googlemail.com   Reverse DNS Resolution - No PTR Record found      More Info
smtp    aspmx3.googlemail.com   Reverse DNS does not match SMTP Banner    More Info
smtp    aspmx4.googlemail.com   Reverse DNS does not match SMTP Banner    More Info
smtp    aspmx5.googlemail.com   Reverse DNS does not match SMTP Banner    More Info
dns thedomain.com   Name Servers are on the Same Subnet   More Info
dns thedomain.com   Serial numbers do not match   More Info
dns thedomain.com   SOA Serial Number Format is Invalid   More Info
dns thedomain.com   SOA Expire Value out of recommended range     More Info

I'm more of developer but have some experience with sysadmin stuff, but certainly not the intricacies of MX records and SMTP. Any thoughts?

Jono
  • 117
  • 1
  • 5

1 Answers1

0

What you've asked doesn't point to any problem with MX, DMARC, SPF, SMTP. These look good.

If I understand you correctly, someone was able to read an email addressed to text@example.com and click a confirmation link.

Presumably you see this because you get a copy of each e-mail received by text@example.com. It would be reasonable to assume that other people could have exactly the same capability, it's the simplest explanation. You'd need to go to googlemail and login as text@example.com to find out more.

kubanczyk
  • 13,502
  • 5
  • 40
  • 55
  • There was only me and one other person on that group for the email, I came to a similar conclusion and assumed that maybe someone just hacked the password for that account. Maybe I can check that with google! – Jono Apr 04 '18 at 17:25