Skip to main content

CISA issues alert on email header syntax enabling sender spoofing bypassing authentication protocols

Source Decision Insights Threat Desk Published November 26, 2025 Companies 2
Human View Machine View

2 companies named across 5 categories, one of 78 articles referencing specialized. Previous coverage: Netskope outlines managed SASE solution for financial institutions with FIS partnership (Nov 2025).

Companies mentioned

Best suited for

Persona
Security Operations Practitioner
Decision stage
Which to buy
Adoption curve
Early Majority
Industry
Information Technology / Software & Services / IT Services / Internet Services & Infrastructure

Our classification, not the publisher's statement. Best suited for, not only for.

Email protocols including SPF, DKIM, and DMARC are susceptible to manipulation through crafted email header syntax, allowing attackers to send spoofed messages that seem to originate from legitimate sources.

These vulnerabilities, detailed under Common Vulnerabilities and Exposures (CVE) identifiers yet unspecified, affect email systems that follow standards such as RFC 5321 for Simple Mail Transfer Protocol (SMTP) and RFC 5322 updated by RFC 6854 for Internet Message Format. Attackers exploit the ability to insert multiple addresses in the From: header field using specialized syntax, sometimes combining quotation marks and angle-address notation. This approach allows the displayed sender address to differ from the actual originator, bypassing authentication checks. The use of a null sender (“”) as per RFC 5321 Section 4.5 further complicates sender validation. For example, a user at [email protected] can send an email where the From: header is formatted as [email protected]:[email protected], resulting in [email protected] appearing as the sender. These tactics exploit how some email clients parse headers, potentially deceiving recipients.

The consequence is the impersonation of trusted senders, which undermines domain owner-enforced DMARC policies and bypasses sender verification mechanisms. Research confirms multiple email service providers are affected by these header spoofing techniques.

To address these vulnerabilities, email service providers are advised to verify authenticated outgoing headers rigorously before signing or relaying messages. Tools such as Milterfrom version 1.0.4 include updates aimed at improving verification of authenticated senders in milter-compliant servers. End users are encouraged to inspect original email headers, specifically the From: and Sender: fields, to confirm sender identity before interacting with content that could pose security risks.

The advisory credits Hao Wang and Caleb Sargent from PayPal for reporting the issues and was authored by Vijay Sarvepalli and Renae Metcalf.

Blog post, originally published by Vijay Sarvepalli and Renae Metcalf at kb.cert.org.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-issues-alert-on-email-header-syntax-enabling-sender-spoofing-bypassing-authentication-protocols/",
        "name": "CISA issues alert on email header syntax enabling sender spoofing bypassing authentication protocols",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-issues-alert-on-email-header-syntax-enabling-sender-spoofing-bypassing-authentication-protocols/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@type": "Organization",
      "name": "PayPal"
    },
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Practitioner"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Majority"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Information Technology / Software & Services / IT Services / Internet Services & Infrastructure"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-23T13:00:27-06:00",
    "datePublished": "2025-11-26T01:27:02-07:00",
    "description": "CISA reports email header syntax flaws enable spoofing that bypasses SPF, DKIM, and DMARC, affecting authenticated sender verification.",
    "headline": "CISA issues alert on email header syntax enabling sender spoofing bypassing authentication protocols",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "Vijay Sarvepalli and Renae Metcalf"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://kb.cert.org/vuls/id/517845"
    },
    "keywords": [
      "Authentication",
      "Common Vulnerabilities and Exposures",
      "Exploit",
      "Simple Mail Transfer Protocol",
      "Vulnerabilities"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-issues-alert-on-email-header-syntax-enabling-sender-spoofing-bypassing-authentication-protocols/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      },
      {
        "@id": "https://decisioninsights.ai/registry/saudi-telecom/specialized/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/saudi-telecom/specialized/",
        "name": "specialized"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages