The research presented at NDSS 2025 provides a comprehensive evaluation of security issues surrounding email protocols such as IMAP, POP3, and SMTP, particularly when using TLS encryption and auto-configuration features. This multifaceted study involved testing 49 email clients, leading to the discovery of critical flaws that can result in security downgrades and credential exposure.
The research identified a total of 10 attack scenarios consisting of 17 defects, which include vulnerabilities that allow attackers to redirect connections to servers under their control or compel insecure connections. These problems are exacerbated by misconfiguration, mismanagement, flawed implementation, and compatibility issues among email systems.
Moreover, a large-scale analysis revealed that 49,013 domains were misconfigured, including 19 of the top 1,000 domains. Among the email clients tested, 22 out of 29 were found to be susceptible to these threats, and 27 out of 29 had user interface notification defects that facilitated silent attacks.
Analysis of 1,102 email setup guides from academic institutions showed that current deployment practices often lead users towards insecure configurations. The research underscores a pressing need for organizations to provide detailed manual configuration instructions rather than relying solely on auto-detect features to maintain secure email systems. By doing so, organizations can minimize the risk of inadvertent security lapses and enhance the overall safety of email communication.

Collections

Research from NDSS 2025 reveals widespread security vulnerabilities in email protocols (IMAP, POP3, SMTP) when using TLS encryption and auto-configuration. Testing 49 email clients uncovered 10 attack scenarios with 17 defects enabling connection redirection and credential exposure. Analysis found 49,013 misconfigured domains (including 19 top-1000 domains), 22 of 29 clients vulnerable to attacks, and 27 of 29 with UI defects enabling silent attacks. Study of 1,102 academic email setup guides shows deployment practices often lead to insecure configurations, emphasizing the need for detailed manual configuration instructions over auto-detect features.

NDSS 2025 – Security Analysis of TLS and Auto-detect in Email Ecosystems