Utah-Seeded DNS Attribution Laundering Infrastructure Expansion Dataset - July 13, 2026

This study documents the methodology of sending phishing emails in which legacy university CNAME relationships caused externally operated SMTP infrastructure to appear under trusted institutional hostnames in receiver-generated email headers. We propose the term DNS Attribution Laundering, and the subtype CNAME-Assisted SMTP Attribution Laundering, for this class of misleading infrastructure attribution. Unlike SubdoMailing, the university domains were not used as authenticated sender identities; unrelated sender-controlled domains passed SPF or DKIM while the university hostnames appeared only as DNS-derived infrastructure context. The evidence establishes DNS Attribution Contamination in both cases, but does not establish that either university operated the sending systems or that the infrastructure operator intentionally sought the university attribution.

View the complete study at https://lappuai.com/research/dns-attribution-laundering/