BreakSPF: How Shared Infrastructures Magnify SPF Vulnerabilities Across the Internet

BreakSPF: How Shared Infrastructures Magnify SPF Vulnerabilities Across the Internet

Speakers: Chuhan Wang, N/A, N/A

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=UfROq55eDds

Overview

Email spoofing remains a pervasive and dangerous threat, enabling attackers to impersonate legitimate senders for phishing, spam, and fraud. The Sender Policy Framework (SPF) is a foundational email authentication protocol designed to combat this by verifying the IP addresses of sending mail servers. However, this talk, "BreakSPF," presented by Chuhan Wang at the NDSS Symposium, uncovers a critical and widespread vulnerability in SPF's IP-based trust model, significantly magnified by the ubiquitous adoption of shared infrastructure. The research demonstrates how attackers can bypass SPF validation, leading to convincing spoofing attacks that evade modern email authentication chains.

The core problem identified is the fragility arising from SPF's reliance on IP addresses for trust. Any entity controlling an IP address listed in an email domain's SPF record can forge emails on behalf of that domain. This inherent weakness is exacerbated by two major trends: the centralization of email services, where a single provider's SPF record can authorize thousands of client domains, and the proliferation of cloud services, proxies, and CDNs, which make it exceptionally easy and cheap for attackers to acquire and utilize a vast pool of IP addresses. BreakSPF is the first systematic analysis to bridge the gap between theoretical SPF risks and practical, large-scale exploitation, revealing that even syntactically correct SPF records can harbor severe security flaws due to IP availability.

The talk introduces a novel attack framework, BreakSPF, which leverages IP addresses from public shared infrastructures to exploit overly permissive SPF configurations. By developing a sophisticated methodology for gathering exploitable IP addresses, employing a unique cross-protocol attack to send spoofed emails, and efficiently identifying vulnerable SPF records, the research demonstrates the widespread potential for attackers to launch convincing email spoofing attacks that bypass both SPF and DMARC (Domain-based Message Authentication, Reporting, and Conformance). These findings call for a fundamental reevaluation of current email authentication practices in an era dominated by shared cloud resources.

Background

▶ Watch: Introduction: SPF vulnerabilities magnified by shared infrastructures (0:00)

To understand the profound implications of BreakSPF, it's essential to first grasp the fundamentals of SPF and its role within the broader email authentication ecosystem. SPF is an IP-based standard codified in RFC 7208 that aims to prevent email spoofing by allowing domain owners to specify which IP addresses are authorized to send email on their behalf. The verification workflow is straightforward: (1) Domain administrators publish an SPF record as a DNS TXT record containing a list of approved sender IPs. (2) A receiving email service queries the SPF record for the MAILFROM domain. (3) The sending server's IP address is then compared against the SPF record's list; a match results in an SPF "pass."

An SPF record begins with v=spf1 and consists of qualifier:mechanism:value pairs. Key mechanisms include all (representing all IP addresses, often with a -all qualifier for strict rejection), include (recursively incorporating another domain's SPF record), redirect (redirecting to another SPF record), ip4/ip6 (specific IP addresses or CIDR blocks), and mx (MX hosts of the current domain). Qualifiers like + (pass), - (fail), ? (neutral), and ~ (softfail) determine the verification outcome. For example, v=spf1 +mx ip4:1.1.1.1/24 include:spf.example.com -all allows emails from the domain's MX hosts and a specific IP range, includes another SPF record, and rejects all others.

SPF is one component of a multi-layered email authentication chain designed to compensate for SMTP's inherent lack of sender authentication. This chain includes:

• DKIM (DomainKeys Identified Mail): Uses digital signatures to verify email content integrity and sender authenticity. The sending server signs the email with a private key, and the recipient retrieves a public key from DNS to verify the signature.
• DMARC (Domain-based Message Authentication, Reporting, and Conformance): Builds upon SPF and DKIM by enforcing alignment between the visible MIME From header and the authenticated identifiers from SPF or DKIM. Crucially, DMARC only requires one of SPF or DKIM to pass for authentication success. It also provides reporting mechanisms to domain owners, offering insight into email authentication results.
• ARC (Authenticated Received Chain): Designed to preserve email authentication results (SPF, DKIM, DMARC) across forwarding hops, which can otherwise break SPF and DKIM due to IP changes or content modifications.

Prior research has extensively explored email spoofing attacks, focusing on protocol characteristics, inconsistencies in email systems, or identifying the weakest links in authentication chains. For instance, Hu et al. conducted end-to-end spoofing tests, Chen et al. identified system inconsistencies, and Shen et al. proposed 14 spoofing techniques. Measurement studies have also analyzed SPF, DKIM, and DMARC adoption rates and identified invalid deployments. However, these works often focused on theoretical risks, syntactic analysis, or protocol-level exploits. BreakSPF distinguishes itself by focusing on deployment vulnerabilities through IP address availability, demonstrating how seemingly "correct" SPF configurations can be exploited when attackers can easily acquire IP addresses included in legitimate SPF records. While Pauley et al. studied cloud IP reuse for "cloud squatting," BreakSPF broadens this concern to proactive email spoofing by attackers controlling a vast pool of public cloud and shared infrastructure IP addresses.

Key Findings

▶ Watch: SPF mechanism: workflow, record structure, and qualifiers (2:00)

The BreakSPF research uncovered systemic vulnerabilities in SPF configurations, revealing how shared infrastructure dramatically magnifies these weaknesses into practical email spoofing threats. The key findings are:

• Widespread Vulnerability: The study identified a staggering 23,916 domains vulnerable to BreakSPF attacks. This includes 23 domains within the Tranco top 1,000 and 1,653 domains within the top 100,000, underscoring the pervasive nature of SPF configuration weaknesses across the internet, affecting even high-profile entities like microsoft.com, qq.com, csdn.net, and ieee.org.
• Centralization Magnification: Shared infrastructures, particularly through the widespread use of the include mechanism, severely magnify SPF vulnerabilities. A single IP address, obtainable at a very low cost (averaging less than $0.01 per IP address), was found capable of influencing over 10,000 domains. This highlights a systemic risk where vulnerabilities in a single email provider's SPF management, often included by thousands of clients (e.g., outlook.com by 181,544 domains, google.com by 142,317 domains), can create a massive attack surface.
• Attack Feasibility and Effectiveness: BreakSPF attacks were proven to be practical and effective in real-world scenarios. The researchers successfully sent spoofing emails to prominent email services, including Gmail, which passed both SPF and DMARC verification, demonstrating that these forged emails are convincing and bypass critical authentication layers.
• Novel Cross-Protocol Attack Effectiveness: The introduction of a novel cross-protocol attack model, which leverages HTTP proxies and CDNs to transmit SMTP packets, significantly expands the pool of exploitable IP addresses. The research demonstrated the effectiveness of techniques like SMTP Embedded as HTTP Header (A3) in bypassing proxy defenses, allowing attackers to utilize infrastructure not traditionally associated with direct email sending.
• Pervasive SPF Configuration Issues: Beyond simple syntactic errors (which affected 8.4% of SPF records), the study found that overly broad IP ranges are a significant contributor to vulnerability. Over 51.7% of domains had SPF records that included more than 65,536 (2^16) IP addresses, a range often unnecessary and indicative of insecure configurations. Common grammatical errors included too many DNS lookups (63.15% causing permerror), double SPF records (30.74%), and format errors (5.56%). Alarmingly, 742 domains (0.07%) configured their SPF policy as +pass, allowing any IP address to pass verification.

Technical Deep Dive

▶ Watch: Overview of DKIM, DMARC, and ARC in email authentication (3:00)

The BreakSPF attack model operates under two key assumptions: attackers have access to a wide variety of public services (cloud servers, proxy services, serverless functions, CI/CD platforms, CDNs) to acquire sufficient IP pools, and they can identify popular domains with vulnerable SPF records associated with these IPs. Crucially, the model does not assume Man-in-the-Middle capabilities, DNS alteration, or DNS spoofing.

The attack proceeds through five main steps:

1. Find a Target Domain: Attackers identify domains with vulnerable SPF records, meaning records that include a broad range of IP addresses, some of which the attacker can control or acquire.
2. Choose Public Services: Attackers select public services whose egress IP addresses fall within the vulnerable SPF record of the target domain. These services constitute the shared infrastructure pool.
3. Utilize Public Service for Spoofing: The chosen public service is then used to send crafted spoofing emails to a victim, leveraging its network capabilities to originate the email traffic.
4. Victim's Email Service Verification: The victim's email service receives the spoofed email and verifies the sender's IP against the SPF record of the MAILFROM domain. Since the attacker's IP is legitimately included, SPF verification passes.
5. Victim Receives Forged Email: As SPF passes, and DMARC only requires either SPF or DKIM to pass, the victim receives a convincing, forged email that has successfully passed both authentication protocols.

A significant innovation of BreakSPF is its cross-protocol attack technique, designed to expand the pool of available IP addresses by leveraging HTTP services with forwarding functionality, such as HTTP proxy services and CDNs, to send email packets. This technique relies on two key observations:

• Similarities between HTTP and SMTP: Both are text-based protocols with similar header/body structures and use MIME for data formats.
• Fault Tolerance of Email Servers: Email servers are robust and often ignore unidentified SMTP commands, making them tolerant to unexpected input.

The research identified three types of cross-protocol email spoofing techniques:

• A1: SMTP Embedded as HTTP Body: The entire SMTP communication (HELO, MAIL FROM, RCPT TO, DATA, email content) is embedded within the HTTP request body. This method requires the SMTP service to tolerate numerous SMTP command errors due to HTTP headers.
• A2: SMTP Embedded as HTTP Request: SMTP commands and MIME headers are integrated directly into the HTTP headers. While reducing SMTP command errors compared to A1, significant structural differences can cause some HTTP proxies and CDNs to reject the packet.
• A3: SMTP Embedded as HTTP Header (Optimized A2): This optimized technique embeds SMTP commands and MIME headers into a single HTTP header, exploiting the inconsistency in line break interpretation between HTTP (typically CRLF) and SMTP (often supports both LF and CRLF). By using LF for SMTP commands within an HTTP header, it can bypass defenses implemented against A2 attacks by certain proxy services.

For CDNs, attackers configure the CDN's origin server to point to the MX record of the target email service on port 25. A crafted POST request to the CDN-configured domain is then automatically forwarded to the email service. For HTTP proxy services, attackers modify the HTTP request line and Host header based on the proxy type.

The BreakSPF exploitation workflow involves six main steps:

1. Domain Collection: Initial collection of 7,183,870 domains, including the Tranco top 1 million and their subdomains from a passive DNS dataset.
2. SPF Scanning: Using XMap, SPF records (TXT resource records starting with v=spf1) are queried. A depth-first search (DFS) algorithm with a recursion limit of 10 is used to traverse include and redirect dependency trees. Domains with multiple SPF records (invalid per RFC 7208) are also noted.
3. Data Processing: Analysis of SPF adoption, grammatical correctness, include mechanism usage, and IP coverage. Crucially, a reverse query mechanism for the SPF dependency tree is established, allowing quick identification of all domains that include a given SPF record.
4. Database Building: A critical step mapping IP addresses to domain names. IPv4 addresses from ip4: tags are converted to 32-bit integers and stored in a tree structure, with IP blocks represented as integer ranges. A Web API allows attackers to submit an IP address and query the database to find domains that include that IP within their declared SPF ranges.
5. IP Collection: A comprehensive collection of 87,430 unique IP addresses from five types of shared infrastructure:

• Cloud Servers: IPs from Alibaba, Amazon, Azure, Google, Tencent, Linode, DigitalOcean, and Vultr. Many block port 25 by default but allow requests to open it. Linode opens it by default.
• Proxy Services: IPs from Open Proxies (HTTP, Transparent HTTP, HTTP Tunnel, SOCKS4/5), VPNs (e.g., VPNGate), Tor exit nodes, and Residential Proxies (RESIP). While many restrict port 25, a significant number still allow it.
• Serverless Functions: IPs from FaaS platforms like Alibaba, Amazon, Azure, Baidu, Google, Huawei, and Tencent, often with more relaxed port management.
• CI/CD Platforms: IPs from GitHub Actions, CircleCI, and Vercel. Most do not impose strict port restrictions, except for CircleCI (due to Amazon infrastructure).
• CDN Services: Gcore, Verizon, Alibaba, Fastly, and Tencent CDN providers were identified as allowing origin servers to be directed to port 25, enabling cross-protocol attacks.

The collected IPs span 201 /8 subnets, 11,162 /16 subnets, 49,471 /24 subnets, 4,383 ASNs, and 181 countries/regions, demonstrating high diversity and low acquisition cost (less than $0.01 per IP).

1. Email Spoofing Attack: With an obtained IP and identified vulnerable domain, attackers establish an SMTP connection with the victim's email service and send crafted spoofing emails, which then pass SPF and DMARC verification.

Demo / Proof of Concept

▶ Watch: BreakSPF attack model: objectives and key assumptions (4:00)

The BreakSPF research demonstrated the practical feasibility of these attacks through extensive experimentation and targeted proof-of-concept scenarios. The core demonstration involved successfully sending spoofing emails to prominent email services, including Gmail, which passed both SPF and DMARC verification. This critical outcome validates that the proposed attack framework effectively bypasses existing email authentication chains in real-world environments.

The evaluation categorized BreakSPF attacks into three types, each with specific demonstrations:

1. BreakSPF with Fixed IP Addresses:

This category involves attackers maintaining long-term control over a specific IP address, acting as a legitimate Mail Transfer Agent (MTA). This is less susceptible to common spam defenses like greylisting.

• Cloud Servers: Using IP addresses from various cloud providers, the researchers achieved 19,327 successful hits, impacting 5,462 domain names. This included 10 domain names in the Tranco top 1,000, such as Tencent and Trendmicro. A notable case study involved a Chinese email provider, S, whose subdomains' SPF records included IP addresses from Alibaba Cloud and Huawei Cloud. Companies using S's services would include spf.send**.org in their SPF records, making all 391 domains** (including shopee.ph) that relied on S's service vulnerable to spoofing from these cloud IPs.
• Proxy Services: Utilizing proxy services, 24,053 successful collisions were recorded, identifying 2,707 vulnerable domains, including well-known entities like godaddy.com and ieee.org.

2. BreakSPF with Changing IP Addresses:

In this scenario, attackers cannot pre-determine the outgoing IP but temporarily control it, making traditional IP blacklisting less effective.

• Serverless Functions: Despite a relatively small number of outbound IP addresses from serverless platforms, 5,064 domains were found to be affected. Serverless functions proved to be an efficient method for email spoofing due to their often relaxed port management policies.
• CI/CD Platforms: From 7,223 IP addresses collected from CI/CD platforms, 3,913 successful hits were achieved, affecting 145 domains, including trendmicro.com. A significant case study highlighted how, in April 2022, Microsoft's subdomain _spf1-meo.microsoft.com had SPF records containing IP ranges (e.g., 20.192.0.0/10) associated with GitHub Actions. Although later fixed, this demonstrated that even major tech companies could inadvertently expose themselves to such vulnerabilities through shared infrastructure.

3. BreakSPF with Cross-protocol Attacks:

This category focuses on shared infrastructure where attackers do not directly control the egress IP addresses but instead embed SMTP data into HTTP packets, which are then forwarded by HTTP proxies and CDNs.

• Open HTTP Proxy: A substantial 17,065 domain names were influenced by IP addresses from open HTTP proxies. The largest vulnerable group identified was websitewelcome.com, with 11,344 domains containing its SPF records. The three cross-protocol techniques (A1, A2, A3) were tested across different HTTP proxy models:
• HTTP(s) Proxy: A1 (1,035), A2 (970), A3 (829), resulting in a total of 2,407 unique proxies exploited.
• Transparent Proxy: A1 (1,136), A2 (808), A3 (844), totaling 1,980 unique proxies.
• HTTP Tunnel: 467 proxies (A1, A2, A3 not applicable).
• CDN Services: The research achieved 6,854 successful hits for collected CDN exit node IPs, identifying 564 domains with SPF vulnerabilities, including fastly.com. While all tested CDN services could perform A1 attacks (normal HTTP packets), many had defenses against A2. Notably, only Tencent CDN service was vulnerable to the optimized A3 attack, highlighting the effectiveness of the optimized technique and the flexibility it provides, even with GET requests.

These extensive demonstrations conclusively prove the widespread prevalence and high success rate of BreakSPF attacks, underscoring the critical need for reevaluating SPF management in today's shared infrastructure landscape.

Defensive Implications

▶ Watch: Detailed five-step process of the BreakSPF attack (4:28)

The findings from BreakSPF reveal fundamental weaknesses in the current IP-based email authentication trust model, particularly in the context of pervasive shared infrastructure. Addressing these vulnerabilities requires a multi-pronged approach involving service providers, domain administrators, and the broader security community.

1. Strengthen Port Management by Cloud and Shared Service Providers: The ease with which attackers can acquire IP addresses from cloud servers, proxy services, and other shared infrastructures, and then utilize them to send emails, is a critical enabler of BreakSPF. Cloud service providers, in particular, should implement stricter default outbound port management policies, especially for ports 25 (SMTP) and 465 (SMTPS). While many cloud hosts already restrict port 25, egress communication to port 465 is often unrestricted, providing an alternative channel for spoofing. Proxy services generally exhibit better port restrictions, but inconsistencies remain. Stricter, more consistent port policies across all shared infrastructure providers would significantly raise the bar for attackers.

1. Proactive SPF Vulnerability Detection and Correction: Domain administrators often struggle with the complexity of SPF record management, leading to outdated, overly broad, or syntactically incorrect configurations. To combat this, administrators should regularly audit their SPF records for:

• Grammatical Errors: Correct issues like too many DNS lookups (exceeding the 10-lookup limit), double SPF records, format errors, and spelling mistakes.
• Overly Permissive IP Ranges: Avoid including broad CIDR blocks (e.g., /16 or /24) unless absolutely necessary, especially for services not directly sending email. Over 51.7% of domains currently include more than 65,536 IPs, indicating widespread over-provisioning.
• Vulnerable include Mechanisms: Carefully vet the SPF records of third-party email providers or services included via the include mechanism. A vulnerability in an included record can affect thousands of dependent domains.

The researchers have developed an online detection service at https://breakspf.cloud, which administrators can use to check their SPF records for grammar problems and identify if they contain IP addresses from the collected vulnerable shared infrastructure pools. This tool provides a practical mechanism for proactive defense.

1. Enhance DMARC Adoption and Report Utilization: While SPF is vulnerable, DMARC remains a crucial layer. Improving the adoption and diligent utilization of DMARC reports is paramount. DMARC provides valuable feedback to domain owners on email authentication results, allowing them to:

• Detect Spoofing Attempts: Identify emails sent from unauthorized IP addresses that fail SPF or DKIM.
• Identify Configuration Issues: Pinpoint legitimate email sources that are failing authentication due to misconfigurations in SPF or DKIM.

Administrators should actively analyze DMARC reports to detect emails sent from uncommonly used IP addresses and promptly address any configuration issues. Moving DMARC policies from p=none to p=quarantine or p=reject after careful monitoring can significantly reduce the impact of spoofing.

1. Re-evaluate the IP-Based Trust Model: The fundamental reliance on IP addresses for identity verification in email authentication is a core weakness, especially given the ease of IP acquisition and dynamic nature of cloud environments. Future work in email security should explore alternative authentication mechanisms that are less reliant on static IP addresses or more robust ways to manage SPF records in dynamic cloud infrastructures. The current model struggles to adapt to the fluid nature of modern internet services.

1. Timely SPF Record Updates: Email administrators must ensure that SPF records are updated promptly when sending server IP addresses change due to asset modifications or service provider changes. Obsolete records can inadvertently authorize old, potentially re-assigned IP addresses, creating new attack vectors.

By implementing these defensive strategies, organizations can significantly reduce their exposure to BreakSPF attacks and strengthen the overall security posture of their email systems against sophisticated spoofing attempts.

Key Takeaways

• Widespread and Practical Vulnerability: SPF vulnerabilities are pervasive across the internet, affecting at least 23,916 domains, including high-profile entities in the Tranco top 1,000. These are not theoretical risks but proven practical attacks that bypass SPF and DMARC.
• Shared Infrastructure Magnification: The proliferation of cloud servers, proxy services, serverless functions, CI/CD platforms, and CDNs significantly magnifies SPF weaknesses. A single, low-cost IP address (less than $0.01 per IP) acquired from these shared resources can enable spoofing for thousands of domains, especially through the include mechanism.
• Novel Cross-Protocol Attacks Expand Attack Surface: The BreakSPF research introduced a groundbreaking cross-protocol attack model that leverages HTTP services (proxies, CDNs) to transmit SMTP packets. This expands the attacker's IP pool beyond traditional email-sending infrastructure, with techniques like SMTP Embedded as HTTP Header (A3) effectively bypassing existing proxy defenses.
• Common SPF Misconfigurations are Key Contributors: Beyond syntactic errors, overly broad IP ranges (over 51.7% of domains cover more than 65,536 IPs) and the misuse of the include mechanism are prevalent and critical factors contributing to SPF vulnerabilities.
• Fundamental Flaw in IP-Based Trust: The reliance on IP addresses for email identity verification is fundamentally fragile in the dynamic, shared infrastructure landscape of the modern internet. This calls for a re-evaluation of current email authentication trust models.
• Actionable Mitigation Strategies Exist: Defenders can enhance email security through strengthened port management by cloud providers, proactive use of online SPF detection tools (like https://breakspf.cloud), and improved adoption and analysis of DMARC reports to identify and rectify authentication failures.

About the Speaker(s)

The talk "BreakSPF: How Shared Infrastructures Magnify SPF Vulnerabilities Across the Internet" was presented by Chuhan Wang. The provided metadata does not include a specific title or company for the speaker, but the depth and rigor of the research indicate a strong background in network security, email authentication, and cloud infrastructure vulnerabilities.