Authentication protocols (AU)

Authentication protocols (AU), layer 02 of 09: the path a message takes through the email stack, with this layer highlighted.

Taxonomies › Email infrastructure › Authentication protocols

Layer 02 of 09 · 13 threats · prefix AU

SPF, DKIM, DMARC and ARC prove which domain handled a message, and the danger is that a pass is read as more than it means. These entries treat the protocols as trust signals that can be weaponised, in both the signing and the verifying role.

Scope: SPF, DKIM, DMARC and ARC as trust signals that can be weaponised.

Table: Authentication protocols (AU), 13 threats with their mitigation principles and design measures. The full text is in the PDF and Excel downloads on the email infrastructure taxonomy overview page.

Text version: every entry on this page is in the PDF and Excel downloads on the overview page, where it can be searched and copied.

The threats

  • AU·A Pass as Endorsement
  • AU·K Cross-Tenant Identity
  • AU·Q DKIM Replay
  • AU·J Partial Signature Coverage
  • AU·10 Alignment Confusion
  • AU·9 Identifier Handoff
  • AU·8 Laundered Trust
  • AU·7 Weak or Shared Keys
  • AU·6 Error as Pass
  • AU·5 Policy Override
  • AU·4 Signing Oracle
  • AU·3 Signal Stripping
  • AU·2 Report Channel Abuse

Where this layer touches others

  • Authentication and DNS: DNS covers who can control or falsify an answer. Authentication covers what a genuine answer can be made to mean.
  • Tenancy: Tenant Confusion (DP·7), Cross-Tenant Identity (AU·K) and Shared Reputation Poisoning (SM·8) each cover a different face of shared infrastructure (configuration, identity, reputation). Shared Infrastructure, Shared Fate (T2) is the structural hazard behind all three.

STRIDE, CAPEC and CWE

Of the 13 entries here, STRIDE fits 10 cleanly and 3 only loosely. CAPEC 3.9 has a pattern that describes 2 of them directly, only a generic parent pattern for 8, and nothing for 3. CWE 4.20 names the weakness directly for 7, has only a broader weakness for 6,. The table below gives the mapping entry by entry, with the names of the CAPEC patterns and CWE weaknesses; what the mapping shows across the whole taxonomy is in Mapping the Email Threat Taxonomy to STRIDE, CAPEC and CWE. The Excel, SKOS and STIX downloads carry the same mapping as text.

Table: STRIDE, CAPEC and CWE mapping for Authentication protocols (AU), 13 threats, with each entry's STRIDE categories and fit, CAPEC 3.9 patterns and CWE 4.20 weaknesses. The full mapping is in the Excel, SKOS and STIX downloads on the email infrastructure taxonomy overview page.

← Delivery pipeline (DP) · Email infrastructure overview · Client protocols (CP) →

© 2026 Jonathan Brett Crawley. Licensed under CC BY-NC-ND 4.0 with additional permissions: see the licence on the email infrastructure overview.