I recall that subdomains are their own record inside a DNS, which would imply that anyone can claim that their server is a non-existent subdomain of the real domain

  • MartianSands
    1·
    4 hours ago

    Really? They don’t use TLS at all? That sounds hilariously insecure

    • chameleon@fedia.io
      1·
      11 minutes ago

      The email ecosystem is changing in recent years but yeah, it’s best to expect that there is at least one opportunity for any given email to be sent over the internet unencrypted. MTA-STS has been slowly changing the landscape but adoption isn’t going all that great.