Exposing and Circumventing SNI-based QUIC Censorship of the Great Firewall of China

Email Spoofing with SMTP Smuggling: How the Shared Email Infrastructures Magnify this Vulnerability

Authors: Chuhan Wang (Southeast University and Tsinghua University); Chenkai Wang (University of Illinois Urbana-Champaign); Songyi Yang (Tsinghua University); Sophia Liu (University of Illinois Urbana-Champaign); Jianjun Chen (Tsinghua University and Zhongguancun Laboratory); Haixin Duan (Tsinghua University and Quan Cheng Laboratory); Gang Wang (University of Illinois Urbana-Champaign)

Conference: USENIX Security

YouTube: This article is based on a peer-reviewed paper presented at USENIX Security 2025; no video recording is available.

Overview

This groundbreaking research paper delves into the profound implications of SMTP smuggling, a sophisticated email spoofing vulnerability that bypasses established authentication protocols like SPF (Sender Policy Framework) and DMARC (Domain-based Message Authentication, Reporting & Conformance). First publicly disclosed in December 2023, SMTP smuggling exploits inconsistencies in how different Mail Transfer Agents (MTAs) process the end-of-data indicator within an SMTP DATA command, allowing attackers to embed malicious SMTP commands within an email body and "smuggle" a second, spoofed email. The study provides the first comprehensive evaluation of this vulnerability, assessing its prevalence across public email services, open-source email software, and email security gateways.

Authored by researchers from Southeast University, Tsinghua University, and the University of Illinois Urbana-Champaign, this paper introduces novel, ethical methodologies for measuring the vulnerability in private email services, including user studies, a DKIM verification side-channel, and a non-intrusive testing method. Their empirical findings reveal a disturbing landscape: 19 public email services, 1,577 private email services, five open-source email software packages, and one commercial email gateway were found to be vulnerable. Crucially, the research highlights how the increasing centralization of email infrastructures, such as shared SPF records and widely adopted email software or gateways, significantly amplifies the impact of SMTP smuggling, enabling adversaries to spoof highly reputable domains using free-to-register email accounts.

The significance of this work cannot be overstated. Email spoofing is a cornerstone of phishing attacks, and the ability to bypass SPF and DMARC renders traditional email authentication mechanisms ineffective against SMTP smuggling. This vulnerability permits attackers to impersonate trusted senders, from internal organizational leaders (e.g., a CEO within a company) to high-profile brands (e.g., YouTube, Microsoft) that rely on shared email services. The paper not only exposes the widespread nature and amplifying factors of this threat but also provides concrete short-term and long-term mitigation strategies, alongside an online self-diagnosis tool to aid email administrators in securing their systems.

Background

The foundation of email transmission lies with the Simple Mail Transfer Protocol (SMTP), which dictates how Mail Transfer Agents (MTAs) send and receive messages. An SMTP conversation begins with an EHLO command, followed by MAIL FROM:, RCPT TO:, and DATA commands to initiate the transmission of the email body. The critical element for this vulnerability is the end-of-data indicator, which, according to RFC 5321, must be \r\n.\r\n (Carriage Return, Line Feed, period, Carriage Return, Line Feed). However, historical differences in operating systems and server implementations have led some MTAs to accept variations, such as \n.\n. Furthermore, command pipelining, an SMTP extension allowing senders to send multiple commands in batch without waiting for individual replies, plays a crucial role in enabling the smuggling aspect of the attack.

SMTP, by design, lacks built-in authentication, making it inherently vulnerable to sender spoofing. To counter this, several security extensions were introduced:

• Sender Policy Framework (SPF): Authenticates sender domains based on IP addresses. Domain administrators publish a DNS record listing authorized IP addresses for sending emails on behalf of their domain. Receiving MTAs check if the connecting IP is permitted.
• DomainKeys Identified Mail (DKIM): Cryptographically signs email messages using public-key cryptography. A DKIM signature header, which includes a selector to find the public key in DNS, covers selected headers and parts of the message body. The receiving MTA verifies this signature.
• Domain-based Message Authentication, Reporting & Conformance (DMARC): Builds upon SPF and DKIM. It allows domains to publish policies on handling authentication failures and requires domain alignment: the "From:" header domain must align with the authenticated domain from SPF or DKIM. For DMARC to pass, at least one of SPF or DKIM must pass, and its authenticated domain must align with the From: header.

SMTP smuggling, as discovered by SEC Consult in December 2023, exploits inconsistencies in how sending and receiving MTAs process the end-of-data indicator. The core idea is to embed additional SMTP commands within the body of an email. If the receiving MTA misinterprets a sequence like \n.\n within the email body as the end-of-data indicator, it will prematurely terminate the first email and then interpret subsequent embedded text as new SMTP commands (e.g., MAIL FROM:, RCPT TO:, DATA), thanks to pipelining. This effectively splits one email into two, with the second "smuggled" email being controlled by the attacker.

The seriousness of SMTP smuggling stems from its ability to bypass both SPF and DMARC. When a smuggled email is processed, the receiving server sees it as originating from the legitimate IP address of the sending MTA (which the attacker used to send the initial, legitimate-looking email). Since this IP is authorized by the domain's SPF record, SPF passes. DMARC also passes because SPF passed, and the attacker can specify a "From:" header that aligns with the authenticated domain. This allows an attacker to spoof any account within the sending domain (e.g., [email protected] from [email protected]). The threat is further magnified by shared SPF infrastructures, where many organizations include the SPF records of large email providers (e.g., Google, Microsoft) in their own. If an attacker uses a vulnerable sending service from such a provider, they can spoof not only accounts within that provider's domain but also any domain that shares its SPF infrastructure. The original vulnerability report lacked extensive testing of variants and a comprehensive evaluation of mitigation effectiveness, gaps this paper addresses.

Key Findings

The research presents a comprehensive and alarming picture of SMTP smuggling's pervasive impact, highlighting several critical findings:

• Widespread Vulnerability: Empirical measurements across diverse email infrastructures revealed significant susceptibility:
• Public Email Services: 19 out of 22 tested public email services (combining sending and receiving sides) were found vulnerable. This includes major providers like Gmail, Outlook, Yahoo, Sina, Sohu, Yandex, Fastmail, and Daum.net.
• Private Email Services: A staggering 1,577 private email services among the Tranco Top 10,000 domains were susceptible to SMTP smuggling, with 20 of these within the top 100 domains. A user study further confirmed 23 out of 48 university email systems were vulnerable.
• Open-Source Email Software: Five widely used open-source email software packages (Postfix, Sendmail, Exim, Haraka, Axigen) were found vulnerable on the sending side, with Haraka and Axigen also vulnerable on the receiving side. Even latest versions often failed to fully mitigate the issue.
• Email Security Gateways: At least one commercial email gateway, TrendMicro, was found vulnerable on the receiving side. SMTP banner analysis suggested high vulnerability rates for Proofpoint (91.1%), Cisco (81.1%), and Forcepoint (100%) based on their association with vulnerable domains.

• Discovery of New Attack Variants: The researchers expanded upon previously known SMTP smuggling payloads, identifying 13 distinct payloads (A1-A13) that effectively exploit the vulnerability. Notably, payloads A8-A13 are new and involve the null character (\x00), which many email systems treat as a string terminator, allowing it to bypass existing filtering mechanisms in services like Gmail and Yahoo.

• Amplification by Centralized Email Infrastructures: The study conclusively demonstrates that the centralization of email services significantly magnifies the impact of SMTP smuggling:
• Shared SPF Records: Many organizations rely on large email providers, incorporating their SPF records into their own. This means that if the provider's sending MTA is vulnerable, an attacker can spoof any domain that shares that SPF infrastructure. For instance, Outlook's shared SPF infrastructure encompasses 81,718 domains, and Gmail's covers 63,225 domains within the Tranco Top 1 Million, including high-profile targets like youtube.com, twitter.com, microsoft.com, and netflix.com.
• Common Software and Gateways: The widespread use of a small set of popular open-source email software (e.g., Postfix) and security gateways (e.g., Proofpoint) means that vulnerabilities in these core components automatically affect a vast number of domains.

• Ethical Measurement Methodologies for Private Services: For the first time, the paper proposes a set of novel, ethical methodologies for testing private email systems without user disruption. These include a user study combined with a DKIM verification side-channel (which achieved 100% accuracy in validation) and a non-intrusive testing method that only sends a vulnerability report if the service is genuinely vulnerable, otherwise terminating the SMTP session early.

• Proof of Concept for High-Profile Spoofing: The research successfully demonstrated that attackers could spoof highly reputable domains, such as [email protected] (via a free Gmail account) or [email protected] (via a free Outlook account), bypassing both SPF and DMARC verification.

• Online Self-Diagnosis Tool: To aid email administrators, the researchers developed and deployed an online service (https://smuggling.breakspf.cloud) that allows self-diagnosis of SMTP smuggling vulnerabilities, sending 13 test emails with various payloads to a specified address.

These findings underscore the urgent need for updated security practices and comprehensive mitigation strategies across the entire email ecosystem, given the widespread nature and amplified impact of SMTP smuggling.

Technical Deep Dive

SMTP smuggling exploits a fundamental inconsistency in how different Mail Transfer Agents (MTAs) interpret the end-of-data indicator and process subsequent commands, often exacerbated by the SMTP pipelining extension. A successful attack requires two conditions:

1. Vulnerable Receiving MTA: The receiving MTA must misinterpret a specially crafted sequence within the email body as the end-of-data indicator (\r\n.\r\n), causing it to prematurely terminate the first email and process subsequent embedded text as new SMTP commands.
2. Vulnerable Sending MTA: The sending MTA must transmit the email body containing the attacker's payload without filtering, modifying, or interpreting the embedded SMTP commands itself.

Attack Payloads

The research significantly expanded the known attack surface by fuzzing popular open-source email software (Postfix, Sendmail, Exim) to identify effective payloads. This led to the discovery of 13 distinct payloads (A1-A13), building on the original report's examples. These payloads are variations of line endings and the period character, with crucial additions involving the null character (\x00):

| ID | Payload | Description |

|---|---|

| A1 | \n.\n | The original SMTP smuggling payload.