The severity is assessed as LOW because the issue primarily affects email deliverability rather than direct security vulnerabilities. There are no known exploits, and the primary concern is operational rather than security.
The scenario describes a situation where SPF and DKIM configurations are needed for SaaS email sending, but the service provider (Gusto) lacks proper configuration knowledge. The impact is potential email deliverability issues due to failed authentication checks by recipients' mail servers.
Affected Systems
- Microsoft 365
- Gusto SaaS Email Service
Affected Versions: All versions using Microsoft 365 for domain management
Remediation
- Configure SPF records on the Microsoft 365 domain to include Gusto's IP addresses or ranges.
- Set up DKIM keys in the Microsoft 365 domain and configure signing with Gusto, if possible.
- Contact Gusto support again for specific email sending IPs that should be included in SPF.
Stack Impact
This affects services used by SaaS applications interfacing with Microsoft 365 domains for email operations.