Content deleted Content added
Added {{Advert}} and {{Primary sources}} tags |
Citation bot (talk | contribs) Added date. | Use this bot. Report bugs. | Suggested by Abductive | Category:Anti-spam | #UCB_Category 73/91 |
||
| (33 intermediate revisions by 31 users not shown) | |||
Line 1:
{{Short description|Canadian technology company}}
{{Multiple issues|
{{Advert|date=August 2021}}
{{Primary sources|date=August 2021}}
{{No footnotes|date=June 2023}}
}}
{{Infobox company
| name = MailChannels
| logo =
| type = [[Private company|Private]]
| industry = [[information_security|Information Security]], [[Software as a service|SaaS]]
Line 18 ⟶ 20:
| net_income =
| slogan =
| homepage =
}}
'''MailChannels''' is a Canadian technology company that specializes in email security for businesses and [[Internet service provider|internet service providers]] (ISPs). Founded in 2004 by Ken Simpson and headquartered in [[Vancouver, British Columbia]], the company operates in [[Anti-spam_techniques|email security]] and the infrastructure market. The business provides a products and services designed to safeguard email systems against [[Spamming|spam]], [[phishing]], and other harmful content. They guarantee the dependable delivery of legitimate messages and offer a mail relay API for numerous websites{{Citation needed|date=August 2024}}.
==MailChannels==▼
==Company history==
The company's first product was an SMTP proxy that provides [[Tarpit (networking)|tar-pitting]] and transparent [[SMTP proxy]] functionality for inbound [[email]] filtering
In 2007, MailChannels joined
In 2010, the company launched an outbound [[email filtering]] software that claims to be capable of filtering up to 30 million messages per hour, transparently in the network. Outbound email filtering involves scanning email traffic as it exits the network, identifying compromised accounts, and reducing the risk of having IP addresses blocked by receiving networks.
In 2013, the company launched a [[cloud-based]] outbound email filtering service.
In 2018, the company launched a cloud-based inbound email filtering service.
In 2022, the company decided to stop supporting [[Plesk]] for outbound email filtering.
== MailChannels and Email Authentication Considerations ==
In August 2023, security researcher Marcello Salvati presented findings at [[DEF CON|DEF CON 31]] regarding what he termed a potential vulnerability in MailChannels' email infrastructure.<ref>{{Citation |title=DEF CON 31 - SpamChannel - Spoofing Emails From 2M+ Domains & Virtually Becoming Satan - byt3bl33d3r | date=16 September 2023 |url=https://www.youtube.com/watch?v=NwnT15q_PS8 |access-date=2023-09-27 |language=en}}</ref> Salvati's research demonstrated that it was possible to send emails addressed from any domain through a free email sending API that MailChannels had been offering to [[Cloudflare]] Workers users. Salvati's talk highlighted how email receivers often interpret a passing [[Sender Policy Framework|SPF]] check as an indication that an email message was authentically sent by the owner of a given domain name, even though the [[Sender Policy Framework|SPF]] RFC specifically advises against interpreting SPF results in this manner.<ref name="RFC7208">{{cite IETF |rfc=7208 |section=2.4 |title=Sender Policy Framework (SPF) for Authorizing Use of Domains in Email, Version 1 |date=April 2014}}</ref>
SPF has several notable limitations that are described in the RFC:<ref name="RFC7208" />
# SPF only authenticates the envelope sender (MAIL FROM) and HELO/EHLO identities, not other identities in the message headers.
# A passing SPF result does not guarantee the message is not spoofed or malicious.
# SPF can't verify specific email addresses, only domains.
The authors recommend receivers use SPF as part of a larger set of evaluations rather than treating it as dispositive on its own.<ref name="RFC7208" />
Furthermore, [[RFC 5321]], which defines [[SMTP]], explicitly states that SMTP mail is inherently insecure:
{{Quote|SMTP mail is inherently insecure in that it is feasible for even fairly casual users to negotiate directly with receiving and relaying SMTP servers and create messages that will trick a naive recipient into believing that they came from somewhere else. [...] Real mail security lies only in end-to-end methods involving the message bodies, such as those that use digital signatures.|RFC 5321, Section 7<ref>{{cite IETF |rfc=5321 |section=7 |title=Simple Mail Transfer Protocol |date=October 2008}}</ref>}}
▲=== MailChannels' Response ===
MailChannels CEO Ken Simpson addressed the complexity of the situation, stating, "MailChannels sends email for 30 million different domains that are hosted behind over 600 web hosting provider networks. We cannot force every domain owner to verify the ownership of their domain because domain owners do not even authenticate domain ownership with their own hosting provider".<ref>{{Cite web |last=Sabin |first=Sam |date=11 August 2023 |title=Exclusive: An email security vendor is leaving 2M domains open to phishing hacks, study finds |url=https://www.axios.com/2023/08/11/mailchannels-security-phishing-hacks-study |url-status=live |archive-url=https://web.archive.org/web/20230816160130/https://www.axios.com/2023/08/11/mailchannels-security-phishing-hacks-study |archive-date=16 August 2023 |access-date=28 September 2023 |website=Axios}}</ref>
In response to these findings, MailChannels developed and implemented a new security feature called "Domain Lockdown." This feature enhances domain authentication by linking registered domain names to MailChannels accounts and implementing sender ID verification, providing an additional layer of security beyond SPF.<ref>{{Cite web |date=21 June 2023 |title=Introducing MailChannels Domain Lockdown |url=https://community.cloudflare.com/t/introducing-mailchannels-domain-lockdown/523913 |access-date=28 September 2023 |website=Cloudflare}}</ref> While not requiring [[Cloudflare]] users to register an account with MailChannels, since the mechanism operates using DNS records alone.
==See also==
Line 51 ⟶ 68:
==References==
{{Reflist}}
{{DEFAULTSORT:MailChannels}}
[[Category:Anti-spam]]
[[Category:Technology companies established in 2004]]
[[Category:Canadian companies established in 2004]]
| |||