[sylware]

SMTP was designed to work without DNS, you are not forced to pay the DNS mafia. To send and receive emails.

If you pay the DNS mafia, dkim and dmarc are overkill/excessive and SPF is more than enough.

And with an IP only SMTP server, SPF is builtin: the reply-to address must include the same IP than the one use to send the email. No DNS here and still a very good SPF validation.

So, all that has a nasty smell of big email providers trying to give hell to self-hosted people/orgs, or a mistake of admins of big email providers).

You have to tell those admins, and if actually a blockade is detected, you have to go legal.

Additionally, if those are malicious expect them to shadow hire (a) team(s) of hackers to destroy your public servers.

[throwaway2346mg]

I'm not sure if this is relevant in regards to the security disclosure itself. If you're not using Mailgun then this doesn't affect you.

However, with regards to "SPF is more than enough", the fact here is that the SPF header isn't passed to the webhook, so it can't used in a mailgun inbound route.