  As a fundamental communicative service, email is playing an important role in
both individual and corporate communications, which also makes it one of the
most frequently attack vectors. An email's authenticity is based on an
authentication chain involving multiple protocols, roles and services, the
inconsistency among which creates security threats. Thus, it depends on the
weakest link of the chain, as any failed part can break the whole chain-based
defense. This paper systematically analyzes the transmission of an email and
identifies a series of new attacks capable of bypassing SPF, DKIM, DMARC and
user-interface protections. In particular, by conducting a "cocktail" joint
attack, more realistic emails can be forged to penetrate the celebrated email
services, such as Gmail and Outlook. We conduct a large-scale experiment on 30
popular email services and 23 email clients, and find that all of them are
vulnerable to certain types of new attacks. We have duly reported the
identified vulnerabilities to the related email service providers, and received
positive responses from 11 of them, including Gmail, Yahoo, iCloud and Alibaba.
Furthermore, we propose key mitigating measures to defend against the new
attacks. Therefore, this work is of great value for identifying email spoofing
attacks and improving the email ecosystem's overall security.
