Hello,
We are a group of security researchers at Virginia Tech. We are conducting a research study on how the SMTP servers out in the wild verify the SPF records and while doing so, we have found a security vulnerability at your end that may allow an attacker to launch a denial-of-service attack using SPF referrals.

An attacker may use an infinite number of SPF referrals in his/her SPF setting and can send an email to your mail server which would make your SMTP server make a lot of DNS queries. By exploiting this vulnerability, an attacker can block your SMTP queue, flood the associated recursive resolver, or any DNS authoritative server.

According to RFC recommendations (https://datatracker.ietf.org/doc/html/rfc7208#section-4.6), a few DNS lookup limits exist that an SMTP server needs to maintain while resolving an SPF record. That is, SPF implementations MUST limit the total number of query-causing terms to 10 and the number of void lookups to 2 to avoid unreasonable load on the DNS.

According to our study, your mail server software violates at least one of these limits, which may pave the way for an attacker to misuse your server and launch a DoS attack that might affect DNS and SMTP services.

Hence, we are sending this email as part of a private disclosure. Please patch your mail server software and the associated SPF milter and update it to the latest version, if possible. If any customization to query limits has been made by an administrator manually, please check it and rectify it as soon as possible.