testing-smtp-smuggling-and-email-spoofinglisted

# Testing SMTP smuggling and email spoofing: authenticated, and still forged Email authentication is a stack of three records that only stops spoofing if all three are present, aligned, and enforced - and even then only if every server on the delivery path agrees where one message ends and the next begins. The failures are quiet: a policy published but set to take no action, a signature that validates a domain that is not the visible sender, a subdomain with no policy, and the boundary desync where two servers parse the end-of-data sequence differently, letting a forged message ride inside a legitimate one and pass every check. You find them by testing what actually gets delivered and trusted, not by reading the records and assuming they hold. ## When to use - You are auditing a domain's email authentication or a mail server's message handling. - The domain publishes sender-authentication records, or receives mail through more than one hop. - You can send test mail into the path and observe what is accepted and how it is judged. ## Scope check Test mail authentication and delivery only for domains and servers you own or are authorized to assess, sending only to mailboxes you control. Spoofed mail to third parties is out of scope and often unlawful. If you can't name the authorization, stop. ## The loop 1. **Map the mail path and the records.** Identify the servers a message crosses inbound and outbound, and retrieve the domain's sender-authentication records: the au