SpamChannel: Spoofing Emails from 2M+ Domains
byt3bl33d3r demonstrates spoofing emails from over two million domains, bypassing SPF and DMARC by exploiting trust architectures between cloud edge services.
Summary
Fragility in Modern Email Authentication
Despite widespread adoption of SPF, DKIM, and DMARC email security records, underlying routing integrations between transactional email providers and cloud edge platforms create critical authentication gaps.
Exploiting Cloudflare and Transactional Email Integrations
byt3bl33d3r analyzes how edge serverless applications interact with major transactional email delivery services, discovering authorization flaws in domain verification pipelines.
Bypassing SPF and DMARC at Global Scale
By abusing shared backend trust boundaries, an attacker can forge cryptographically signed emails appearing from over two million legitimate commercial domains without owning their DNS records.
Tool Release and Mitigation Strategies
The author demonstrates the attack tooling, analyzes the root causes of serverless identity confusion, and provides architectural recommendations for cloud email providers.
Related talks
Cloud Village·23 min
Aviram · Uri Gutman
Lessons from building a scalable security platform on serverless cloud infrastructure.
RSAC Cybersecurity·52 min
Engineers explore architecture and security mechanisms for Defending Serverless Infrastructure in the Cloud.
RSAC Cybersecurity·45 min
Security researchers examine technical aspects of Securing Serverless Applications in the Cloud.