Support Library
SPF/DMARC Misconfigurations
Weak email auth policies let attackers spoof trusted sender identity.
Threat Model
Weak email auth policies let attackers spoof trusted sender identity.
Attack Path
Common misconfigs include p=none stagnation, SPF +all, and overly complex include chains.
Detection Techniques
Lint SPF/DMARC TXT records and monitor alignment plus aggregate-report telemetry.
Mitigation Strategies
Move DMARC to enforcement, tighten SPF scope, and prune obsolete sending services.
Scoring Impact (tie to Panopticon scoring model)
Policy weakness is medium/high; active abuse evidence raises severity.
How DNS Panopticon Detects This
- Relevant checks: Delegation integrity, resolver consistency, DNSSEC health, and suspicious record-pattern checks.
- Severity mapping: Informational, medium/high, or critical based on exploitability and user impact.
- Score impact: Reliability and security scoring dimensions are reduced according to blast radius.
- Related findings users will see: NS drift, validation failure, orphaned CNAMEs, wildcard exposure, and policy misconfiguration alerts.
Operator Checklist
- Verify behavior from at least two public resolvers and one resolver inside your own network before making changes.
- Make one change at a time, capture before/after query output, and wait for TTL windows to clear so you can confirm impact.
- Document the root cause and the final fix in your runbook to shorten future incidents.