There is no potential for spoofing your domain on MailChannels now that Domain Lockdown is required,

There is no potential for spoofing your domain on MailChannels now that Domain Lockdown is required, so I'm not sure why you are advising people to go elsewhere.

Sskoogeer There is no potential for spoofing your domain on MailChannels now that Domain L...

James•8/14/23, 6:20 PM

Was there an announcement for Domain Lockdown now being required? This seems to be a new change.

James•8/14/23, 6:21 PM

I'm very happy this is now required, but considering how easy it is to still spoof many of your customers for a tiny price, and the general response from MailChannels to this whole ordeal, I'm still not comfortable recommending MailChannels, sorry

JJrMasterModelBuilder There's a vague thread over here I found with someone having possibly the same e...

skoogeerOP•8/14/23, 6:30 PM

We check whether your email sender domain has an A, AAAA, or MX record. If it has none of these, then we generate the SDNF rejection error. Make sure the sending email address - the one specified in the "from" parameter in your API call - successfully resolves.

JJames I'm very happy this is now required, but considering how easy it is to still spo...

skoogeerOP•8/14/23, 6:36 PM

The announcement was posted today: https://community.cloudflare.com/t/this-week-mailchannels-will-enforce-domain-lockdown-on-legacy-workers-users/544874

Sskoogeer The announcement was posted today: https://community.cloudflare.com/t/this-week-...

James•8/14/23, 6:37 PM

Yeah I just saw that, thank you for the update

Sskoogeer We check whether your email sender domain has an A, AAAA, or MX record. If it ha...

JrMasterModelBuilder•8/14/23, 6:45 PM

So it would just need any A, AAAA, or MX record for noreply.example.comnoreply.example.com ?

skoogeerOP•8/14/23, 6:52 PM

That is correct.

skoogeerOP•8/14/23, 6:52 PM

If you're still getting an error, please send us a support ticket and our team will check it out further looking at our logs to determine the rest of the context.

HHello, I’m Allie!Wasn’t there also a thing about how because they have ARC enabled then it can by...

skoogeerOP•8/14/23, 6:54 PM

The ARC support is intended to improve security by adding a signature verifying the integrity of the headers that we saw when the mail was submitted to us. It's not intended to help bypass any receiver security measures. I think that the DEFCON researcher is misguided in his interpretation of ARC being some kind of backdoor. It's very much not that.

Sskoogeer The ARC support is intended to improve security by adding a signature verifying ...

zegevlier•8/14/23, 7:43 PM

I think that the DEFCON researcher is misguided in his interpretation of ARC being some kind of backdoor.

That was not the impression I got from reading the slides. I understood it as "This is another thing that MailChannels does that makes it easier for abuse to get delivered", which seems accurate

James•8/14/23, 7:47 PM

Agreed ^. You need to address how you're planning to fix the underlying issues brought up in the entire talk @ttul

archon810•8/14/23, 8:12 PM

Hi,

Now that firewall rules have become custom rules, we can finally specify a custom HTML block response per rule, which is fantastic.

However, a few things could be improved.

There’s no way to quickly customize just the block reason because custom HTML replaces the whole block page. Ideally, there’d be a way to use an existing CF template and just customize the block reason.

To work around that, I pulled HTML from CF’s existing block page and made a few tweaks, including specifying a custom reason. Upon submitting the HTML, I saw that the response limit is a measly 2048 bytes, which isn’t even enough to serve CF’s own block page. I had to cut it down severely. Ideally, the limit would be a bit higher - at least 4096 bytes.

How do we use dynamic fields in responses? I tried using ::RAY_ID:: and ::CLIENT_IP:: per https://developers.cloudflare.com/support/more-dashboard-apps/cloudflare-custom-pages/configuring-custom-pages-error-and-challenge/, but they just got output verbatim instead of their dynamic values.

valkyrie_pilot•8/14/23, 9:31 PM

can cloudflare images scan for illegal and other unsavory content at upload?

Dubz•8/14/23, 9:44 PM

Is there a way we can transfer domains from one account to another if it's registered on Cloudflare, without renewing/transferring? I'd imagine that could be an issue being the same registrar, but support may be able to do it?

DDubz Is there a way we can transfer domains from one account to another if it's regis...

Erisa•8/14/23, 9:46 PM

There isn't, I recommend upvoting it here https://community.cloudflare.com/t/feature-request-registrar-transfer-between-cloudflare-accounts/540582

Cloudflare Community

Feature Request: Registrar Transfer between Cloudflare Accounts

Currently, domains registered with Cloudflare Registrar cannot be transferred between Cloudflare accounts. This is a request to add the ability to transfer domains registered in one Cloudflare account to another Cloudflare account This inability to transfer between accounts can be a significant roadblock. A person may have to go through the pro...

Dubz•8/14/23, 9:47 PM

Can it be done with an official transfer request, or does that not work within the same registrar?

Dubz•8/14/23, 10:01 PM

That's wack

Dubz•8/14/23, 10:01 PM

Thanks for the info tho

clerick x•8/15/23, 2:28 AM

CF_PAGES_URL is the preview url for some reason

EErisa Ticket was what I would have recommended so all good

sathoro•8/15/23, 4:55 AM

still waiting on this meanwhile Free Cloudflare zones get 1 rate limiting rule by default which is all we needed D:

Ttaylorswiftfan Are there any resources on how to actually use Cloudflare CDN? The docs have 0 m...

Karew•8/15/23, 5:33 AM

The TLDR is: (1) Make sure the domain/subdomain you’re using has the orange cloud icon in the Cloudflare DNS settings, which means Cloudflare is protecting it (2) Set up Cache Rules to specify rules for files you want to cache, otherwise you get the default CDN behavior

Karew•8/15/23, 5:34 AM

Anything behind Cloudflare is already using the CDN

chientrm.com•8/15/23, 5:51 AM

Screen_Shot_2023-08-15_at_12.51.20_PM.png

Soham•8/15/23, 6:40 AM

https://www.techradar.com/pro/cloudflare-tunnels-are-being-used-to-breach-networks

TechRadar

Cloudflare Tunnels are being used to breach networks

Benign tool is being used to steal data by abusing Cloudflare Tunnels

Soham•8/15/23, 6:52 AM

Is cloudflare aware of this?

SSoham Is cloudflare aware of this?

chientrm.com•8/15/23, 6:57 AM

perfect tool.

chientrm.com•8/15/23, 6:57 AM

May aswell grab the credentials inside ~/.cloudflare and do funny back.

Soham•8/15/23, 7:00 AM

Does the folder even exist if you install cloudflared as a service though?

Soham•8/15/23, 7:01 AM

I thought it was only for if you manually configured the tunnel

SSoham Does the folder even exist if you install cloudflared as a service though?

chientrm.com•8/15/23, 7:02 AM

yep afaik.

SSoham I thought it was only for if you manually configured the tunnel

Hello, I’m Allie!•8/15/23, 8:21 AM

The only time it doesn’t exist is when you run a Dash Tunnel manually

Ssathoro still waiting on this meanwhile Free Cloudflare zones get 1 rate limiting rule b...

Erisa•8/15/23, 8:42 AM

Hey, what's the ticket number? I can take a look for you

EErisa Hey, what's the ticket number? I can take a look for you

sathoro•8/15/23, 8:43 AM

2894026 thank you!

Erisa•8/15/23, 8:44 AM

On it

SSoham https://www.techradar.com/pro/cloudflare-tunnels-are-being-used-to-breach-networ...

Dubz•8/15/23, 8:48 AM

I had the same thoughts about tunnels when it launched, but didn't want to be that guy to give birth to it. Then again, if I thought of it, so would someone else...

Ssathoro 2894026 thank you!

Erisa•8/15/23, 8:52 AM

Added RL and replied, sorry again for the trouble!

Erisa•8/15/23, 8:52 AM

there is an explanation of sorts in the ticket

EErisa Added RL and replied, sorry again for the trouble!

sathoro•8/15/23, 11:39 AM

thanks

SSoham https://www.techradar.com/pro/cloudflare-tunnels-are-being-used-to-breach-networ...

Cyb3r-Jak3•8/15/23, 11:49 AM

I mean it’s the same with any tunnel program like ngrok or even net cat. If a free tool exists it will get abused

Gglendc Would there be a channel here where I can propose some possible contributions to...

Erisa•8/15/23, 4:06 PM

The Issues on that repo would be the most appropriate place

Dubz•8/15/23, 9:22 PM

Is it possible to block cloudflared from being used as a service but not as a client? WARP is not an option in my circumstances but curious if the service/client side of cloudflared use different hostnames and/or ports

Erisa•8/15/23, 9:38 PM

Sure, just do the opposite of these https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/install-and-setup/ports-and-ips/

Tunnel with firewall · Cloudflare Zero Trust docs

Users can implement a positive security model with Cloudflare Tunnel by restricting traffic originating from cloudflared. The parameters below can be …

There is no potential for spoofing your domain on MailChannels now that Domain Lockdown is required,

Similar Threads

Similar Threads

Similar Threads