NDSS 2025 – Automatic Insecurity: Exploring Email Auto-configuration In The Wild

This research paper examines insecurity in email auto-configuration, presenting 10 attack scenarios across 17 defects (including 8 new issues) and four UI-notification flaws that can cause users to connect to attacker-controlled servers or use insecure connections, risking credentials; large-scale measurements found 49,013 misconfigured domains (including some top-1K) and 22 of 29 clients vulnerable, highlighting systemic misconfiguration, implementation, and compatibility problems.