search

Homas / ioc2rpz.gui

ioc2rpz webgui
Apache License 2.0
14 stars 3 forks source link

Permit + character in email addresses #12

Closed dmgeurts closed 2 years ago

dmgeurts commented 2 years ago

Just tried to set my email address as djerk+ioc2rpz@domain.com and found that the form for servers doesn't permit the use of the "+" character. Please can this character be added as permitted in the username before the @

This is often used to track where an email address was used, either for filtering by the recipient, or tracking where an email address was obtained/leaked/stolen/etc.

Homas commented 2 years ago

The ioc2rpz.gui doesn't accept emails as usernames. Do you mean the ioc2rpz community website?

dmgeurts commented 2 years ago

No, I mean the admin email field when adding/editing servers: image

Homas commented 2 years ago

Got it. This email is used for a zone SOA record. From one side (one RFC) in domain name format should not allow "+" sign, from other side DNS can contain any chars in resource records. Did you validate such SOA records with ISC Bind and PowerDNS?

dmgeurts commented 2 years ago

I just found I couldn't enter a + in the email address field. I've not done much validation beyond that.

Homas commented 2 years ago

The SOA field is used by other DNS servers and they should be able to understand any extra chars in it. I recommend do not use any important emails in SOA records and if you are not going to expose the feeds in Internet you can really use any fake email (no one will mail you).

dmgeurts commented 2 years ago

Fair point, thank you