When an external security team delivers penetration testing results for a SaaS application or corporate network, email and authentication findings almost always appear in the report. Here is how to interpret and remediate the most common email-related pentest findings.
1. Domain spoofing and permissive DMARC/SPF policies
- Typical finding: "The target domain publishes
p=nonein DMARC or~all/?allin SPF, allowing unauthenticated senders to spoof internal or customer-facing addresses." - Remediation: audit all legitimate sending streams, align SPF and DKIM identifiers for each ESP, and transition your DMARC policy from
p=nonetop=quarantineandp=reject(RFC 7489). Verify the fix with the DMARC Checker and SPF Checker.
2. Unthrottled signup forms and trial abuse
- Typical finding: "Attackers can register thousands of accounts using disposable email services or trigger outbound verification emails to arbitrary addresses (email bombing)."
- Remediation: combine rate limiting with real-time email verification at signup to reject
disposableandinvalidaddresses before queuing outbound transactional mail.
3. Unsigned webhook endpoints and overly broad API keys
- Typical finding: "Webhook listeners accept forged payloads or API keys lack scope/domain restrictions."
- Remediation: verify
HMAC-SHA256signatures (X-ValidReach-Signature) on every webhook and restrict API keys by scope (verify:read,batch:write) and allowed environments in your ValidReach dashboard.
Sources
- NIST SP 800-177 Rev. 1 — Trustworthy Email — accessed 2026-11-04
- OWASP Testing Guide — Testing for Account Enumeration and Identity Management — accessed 2026-11-04
- ValidReach Security Overview — accessed 2026-11-04
