Split Alignment: Diffusing SPF Vulnerabilities With DMARC#

Authors: Muhammad Hamza, Eric Pauley, Taejoong Chung (Virginia Tech), Mattijs Jonker, Raffaele Sommese (University of Twente), Simon Fernandez, Olivier Hureau (Univ. Grenoble Alpes, CNRS, Grenoble INP, LIG)

• Why: Authentication protocols don't compose safely — SPF weaknesses, when layered with DMARC's organizational context, can enable organization-wide spoofing. This is a good study of how layered auth protocols amplify each other's flaws, with a deployable fix.
• What: A comprehensive empirical analysis finding 528k vulnerable SPF policies which, paired with DMARC, enable spoofing of 79k domain hierarchies. The proposed mitigation, Split Alignment, is a configurational technique that protects established sending domains from all SPF failures anywhere in their hierarchy. The validation methodology also surfaced critical DMARC authentication-flow bugs in four major email services (disclosed). (from abstract only)
• How: Large-scale dataset analysis of layered email-auth policies; the mitigation is pure configuration — no protocol change — validated with a reproducible security-and-deliverability test methodology.
• Where applicable: Any organization that sends email at scale and uses SPF/DMARC. Broadly applicable since it is a domain-owner-side configuration technique; the disclosed service bugs show some receivers may mis-handle the configuration, so roll out with the deliverability validation in mind.