> ## Content Index
> Fetch the complete content index at: https://www.ostering.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# SMTP (SM)

- URL: /taxonomies/email-infrastructure/smtp/
- Published: 2026-10-31T13:00:00.000Z
- Updated: 2026-10-29T14:53:07.435Z
- Description: MTP (SM): 13 threats in the email infrastructure threat taxonomy, with mitigations. The MTA-to-MTA conversation: identity, relay, transport security, parsing.
- Author: Brett Crawley

[Taxonomies](/taxonomies/) › [Email infrastructure](/taxonomies/email-infrastructure/) › SMTP

**Layer 04 of 09 · 13 threats · prefix SM**

SMTP accepts whatever identity a peer asserts and secures each hop only if both ends insist. These entries cover the MTA-to-MTA conversation: identity, relay, transport security and parsing.

**Scope:** The MTA-to-MTA conversation: identity, relay, transport security, parsing.

![Table: SMTP (SM), 13 threats with their mitigation principles and design measures. The full text is in the PDF and Excel downloads on the email infrastructure taxonomy overview page.](https://www.ostering.com/media/posts/97/email-taxonomy-table-04-SM.png =1400x4212)

*Text version: every entry on this page is in the [PDF and Excel downloads](/taxonomies/email-infrastructure/) on the overview page, where it can be searched and copied.*

## The threats

- <span id="sm-a"></span>**SM·A** Unauthenticated Identity Assertion
- <span id="sm-k"></span>**SM·K** Relay Abuse
- <span id="sm-q"></span>**SM·Q** TLS Downgrade
- <span id="sm-j"></span>**SM·J** SMTP Smuggling
- <span id="sm-10"></span>**SM·10** Recipient Enumeration
- <span id="sm-9"></span>**SM·9** Command and Header Injection
- <span id="sm-8"></span>**SM·8** Shared Reputation Poisoning
- <span id="sm-7"></span>**SM·7** Submission Identity Mismatch
- <span id="sm-6"></span>**SM·6** Resource Exhaustion
- <span id="sm-5"></span>**SM·5** Trace Forgery
- <span id="sm-4"></span>**SM·4** Extension Differential
- <span id="sm-3"></span>**SM·3** Address Parsing Differential
- <span id="sm-2"></span>**SM·2** Backscatter Reflection

## Where this layer touches others

- **SMTP and delivery pipeline:** SMTP is a single hop's conversation. The pipeline is the composition of hops.
- **Tenancy:** Tenant Confusion (DP·7), Cross-Tenant Identity (AU·K) and Shared Reputation Poisoning (SM·8) each cover a different face of shared infrastructure (configuration, identity, reputation). Shared Infrastructure, Shared Fate (T2) is the structural hazard behind all three.

## STRIDE, CAPEC and CWE

Of the 13 entries here, STRIDE fits 11 cleanly and 2 only loosely. CAPEC 3.9 has a pattern that describes 5 of them directly, only a generic parent pattern for 7, and nothing for 1. CWE 4.20 names the weakness directly for 12, has only a broader weakness for 1,. The table below gives the mapping entry by entry, with the names of the CAPEC patterns and CWE weaknesses; what the mapping shows across the whole taxonomy is in [Mapping the Email Threat Taxonomy to STRIDE, CAPEC and CWE](/email-threat-taxonomy-mapping). The Excel, SKOS and STIX downloads carry the same mapping as text.

![Table: STRIDE, CAPEC and CWE mapping for SMTP (SM), 13 threats, with each entry's STRIDE categories and fit, CAPEC 3.9 patterns and CWE 4.20 weaknesses. The full mapping is in the Excel, SKOS and STIX downloads on the email infrastructure taxonomy overview page.](https://www.ostering.com/media/posts/97/email-mapping-table-04-SM.png =1400x2369)

---

← [Client protocols (CP)](/taxonomies/email-infrastructure/client-protocols/) · [Email infrastructure overview](/taxonomies/email-infrastructure/) · [MIME and S/MIME (MI)](/taxonomies/email-infrastructure/mime-and-s-mime/) →

*© 2026 Jonathan Brett Crawley. Licensed under [CC BY-NC-ND 4.0](https://creativecommons.org/licenses/by-nc-nd/4.0/) with additional permissions: see the licence on the [email infrastructure overview](/taxonomies/email-infrastructure/).*