iCloud spoofing disclosure shows limits of domain authentication
SEC Consult discloses iCloud header-parsing flaws that passed SPF, DKIM and DMARC. Its timeline confirms remediation in December 2025.
What was disclosed
On 1 October 2026, SEC Consult published research into two header-parsing flaws in Apple’s iCloud email service. A signed-in user could send messages appearing to come from another icloud.com address while passing SPF, DKIM and DMARC checks.
Inconsistent header handling enabled the forgery. The service signed the transformed message, allowing DKIM validation to succeed.
The fixes predate the disclosure
SEC Consult’s timeline dates the first report to 21 May 2024, Apple’s deployment confirmation to 12 November 2025, and the researcher’s remediation confirmation to 9 December 2025.
What administrators can learn
A DMARC pass authenticates an aligned domain, rather than a person. Keep authentication checks and impersonation controls, and verify sensitive requests through a separate trusted channel.
The disclosure announces no new DNS requirement or administrator-installed iCloud patch.
Sources
Sources reviewed .