SMTP Smuggling

[An updated version of this text may be found at https://www.postfix.org/smtp-smuggling.html] Author: Wietse Venema Last update: January 22, 2024 Summary Days before a 10+ day holiday break and associated production change freeze, SEC Consult has published an email spoofing attack that involves a composition of email services with specific differences in the way they handle line endings other than

[defiant]

SMTPのDATAの終了を正しくない終わり方にして、サーバーによる実装の違いを使って、DMARCとかのチェックをすり抜けて不正なメールを送れるという感じかな。結構シンプルな仕組みで成立する。