Independent paper review · USENIX Security 2025
Email Spoofing with
SMTP Smuggling
How inconsistent SMTP parsing and shared email infrastructure can enable forged messages to pass SPF and DMARC—and what a broad empirical study found still exposed.
Original research by Chuhan Wang, Chenkai Wang, Songyi Yang, Sophia Liu, Jianjun Chen, Haixin Duan, and Gang Wang · 34th USENIX Security Symposium (2025)
The smuggling condition
The attack depends on disagreement about SMTP's end-of-data marker; shared sending infrastructure can broaden which domains are impersonated.
Goal
Measure the real-world reach of SMTP smuggling after its 2023 disclosure.
The authors asked whether SMTP smuggling's impact had been underestimated—especially where providers, customers, software, gateways, and SPF-authorized IP addresses are shared—and whether mitigation efforts had actually closed the vulnerability.
SMTP smuggling exploits disagreement between mail transfer agents about where SMTP message data ends. An embedded delimiter can be treated as ordinary body content by one server but as the end of a message by another, allowing attacker-supplied SMTP commands to create a second, forged message.
Methodology
A layered measurement across public, private, and product infrastructure.
- 01
Develop and test payload variants
The researchers fuzzed line-ending and character handling in common mail software, producing 13 test payloads, including six variants not covered by the original disclosure.
- 02
Test both sides of public mail delivery
They separately tested whether sending MTAs preserved malicious delimiters and whether receiving MTAs split one message into two, covering 22 public email services as well as open-source software and commercial gateways.
- 03
Measure private services ethically
An IRB-approved user study recruited participants to test 48 university mail systems. A DKIM verification side channel helped determine whether a receiver had split the message without requiring researchers to inspect a participant's mailbox.
- 04
Run a non-intrusive Internet-scale test
For domains in the Tranco Top 10,000, the team used one payload and terminated sessions before a smuggled second message was delivered. If a server was vulnerable, the first message served as a disclosure notice to an administrative address.
- 05
Analyze shared infrastructure
They examined shared SPF authorization and SMTP banners to connect exposure with concentrated providers, widely deployed mail software, and security gateways, then notified affected parties.
Conclusions
The vulnerability persisted, and infrastructure concentration amplified its reach.
These are results reported by Wang et al. at the time of their measurements, not fresh testing by this website.
Exposure remained widespread
The study found vulnerable behavior on sending and receiving paths even after SMTP smuggling had been publicly known for months.
Shared SPF enlarged the blast radius
A vulnerable public provider could, in some configurations, be used to impersonate customer or affiliated domains that authorized the provider's sending IPs.
Centralization created systemic risk
Many affected domains depended on a relatively small set of commonly used mail packages, providers, and gateways, allowing one implementation flaw to propagate broadly.
Strict parsing is essential
The authors recommend immediate normalization or rejection of ambiguous delimiters and longer-term protocol and implementation changes that remove parser disagreement.
Research contribution
What this study added to the field.
Broad empirical coverage
A systematic evaluation spanning public providers, private domains, open-source mail servers, and commercial security gateways, on both sending and receiving sides.
Ethical private-service testing
A combined user-study, DKIM side-channel, and non-intrusive measurement design for studying systems that researchers did not control.
Infrastructure amplification
Evidence that shared SPF authorization and concentrated mail infrastructure turn individual parser flaws into cross-domain spoofing risk.
The researchers responsibly disclosed findings and built a self-diagnosis service for administrators. The paper also distinguishes near-term implementation defenses from longer-term changes needed across SMTP infrastructure.
Original research
Read and cite the authors' paper.
“Email Spoofing with SMTP Smuggling: How the Shared Email Infrastructures Magnify this Vulnerability”, by Chuhan Wang, Chenkai Wang, Songyi Yang, Sophia Liu, Jianjun Chen, Haixin Duan, and Gang Wang, in the Proceedings of the 34th USENIX Security Symposium, 2025. This page is an independent summary and does not claim authorship of the study.