Top 10 winner

SMTP Smuggling - Spoofing E-Mails Worldwide

Timo Longin · SEC Consult

Outbound and inbound SMTP servers disagree on which byte sequence ends message data, so a sequence such as LF dot CRLF passes one server unfiltered and is read as end-of-data by the next. An attacker with any account at an affected provider can smuggle a second, entirely forged message that inherits the provider's IP and so passes SPF, DKIM alignment and DMARC.

Record

Researcher

Timo Longin

Published by

SEC Consult

Topic

Other

In the archive

• Ranked #3 in the 2023 Top 10 Web Hacking Techniques
• Collected in the 2024 research round

Related sources

• Official testing tools
• 37C3 - SMTP Smuggling – Spoofing E-Mails Worldwide

Tags

• smuggling
• parser-differential
• smtp
• email
• filter-bypass
• cve
• large-scale-scan
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Timo Longin, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 11 August 2026.