MailSleuth.AI
Header Forensics
Field notes

The MailSleuth Blog

Phishing forensics, SPF/DKIM/DMARC deep dives, and email threat intelligence — straight from the lab.

An illustration showing a cracked, old-fashioned bronze key being replaced by a modern, glowing, digital key, representi
Threat Intel
Phishing Forensics

The 1024-bit DKIM Key Retirement Playbook

Stop signing email with keys a nation-state can factor; here's how to upgrade to 2048-bit DKIM without breaking a single mail flow.

Jun 21, 2026MailSleuth Research
An editorial illustration showing a tangled string with 12 knots, representing an SPF record exceeding its 10-lookup lim
Threat Intel
Phishing Forensics

Postmortem: How an SPF PermError Let a BEC Attack Past Our Gateway

A single DNS change broke our SPF record, and our secure email gateway treated the resulting error as a pass. This is how it happened.

Jun 21, 2026MailSleuth Research
An illustration showing a single DNS record icon from which a complex, glowing tangle of network cables emerges, represe
Threat Intel
Phishing Forensics

What You're REALLY Authorizing With Google's SPF Record

Your `include:_spf.google.com` authorizes dozens of services beyond Gmail, creating hidden pathways for SPF authentication and DMARC alignment failures.

Jun 20, 2026MailSleuth Research
Illustration of a key attached to a keychain by a link made of crumbling sand, symbolizing a fragile trust dependency in
Threat Intel
Phishing Forensics

Dangling SPF: The Attack Vector Hiding in Your TXT Record

An expired domain in your SPF record isn't just clutter—it's a backdoor for attackers to send fully authenticated email on your behalf.

Jun 20, 2026MailSleuth Research
An abstract illustration of a city map with tangled paths, where one red line highlights a vulnerability in the system,
Threat Intel
Phishing Forensics

M&A Diligence: Your Target’s SPF Record Is a Map of Their Hidden Risk

A target company's messy SPF record isn't just bad DNS hygiene—it's a public CVE waiting to be exploited.

Jun 19, 2026MailSleuth Research
An illustration of the SPF 10-lookup limit showing a chain of dominoes, started by Salesforce, about to fall off a cliff
Threat Intel
Phishing Forensics

When Salesforce Shatters Your SPF: The 10-Lookup Limit Trap

That generic Salesforce SPF `include` is a ticking time bomb for your DMARC compliance, and here’s the exact playbook to defuse it.

Jun 19, 2026MailSleuth Research
An illustration of a single glowing wire being correctly connected to a secure server, representing the process of fixin
Threat Intel
Phishing Forensics

Your PTR Record Is Lying. That’s Why Spamhaus Blocked You.

A 'generic PTR' rejection from Spamhaus means your mail server's reverse DNS doesn't prove ownership, making you look like a spam source.

Jun 18, 2026MailSleuth Research
An illustration of a chameleon made of IP addresses, symbolizing an attacker changing IPs to evade detection on a networ
Threat Intel
Phishing Forensics

Abusing IP Reputation: A Red Teamer's Guide to RBL Evasion

IP reputation isn't a fixed score; it's a resource attackers actively manage, exploit, and discard to bypass your defenses.

Jun 17, 2026MailSleuth Research
An illustration of a massive, clean server building representing Microsoft 365, with a small, obscure blacklist notice o
Threat Intel
Phishing Forensics

Shared IP, Shared Problem: When M365 Lands on an Obscure RBL

Your Microsoft 365 mail is bouncing, but every major blocklist says the IP is clean—the problem is deeper than you think.

Jun 17, 2026MailSleuth Research
An editorial illustration of a server rack where one bad, glowing red cable causes the entire system's status lights to
Threat Intel
Phishing Forensics

Postmortem: How a Botched ESP Migration Got Our Domain Blacklisted

A successful ESP migration blinded us to the subtle DKIM/SPF misalignments that put our domain on a URI blacklist; here's the full triage and delisting process.

Jun 16, 2026MailSleuth Research
An illustration of a cluttered control panel being replaced by a modern dashboard, representing DMARC triage bringing cl
Threat Intel
Phishing Forensics

DMARC Stuck at p=none? An RUA Triage Playbook

Your RUA reports are a goldmine for finding Shadow IT and threat actors, but only if you have a playbook to cut through the noise.

Jun 15, 2026MailSleuth Research
A desk with XML code printouts under a magnifying glass, which highlights a red 'fail' status, symbolizing DMARC report
Threat Intel
Phishing Forensics

Decoding DMARC Failures: A Forensic Guide to RUA & RUF Reports

DMARC dashboards hide the truth; mastering raw XML is how you find the broken mail flows preventing a p=reject policy.

Jun 15, 2026MailSleuth Research
An illustration of a corporate shield with a small keyhole being unlocked by a shadowy figure, symbolizing a DMARC relax
Threat Intel
Phishing Forensics

DMARC's Dirty Secret: Exploiting Relaxed Alignment for Domain Spoofing

Permissive DMARC policies with relaxed alignment are not just misconfigurations—they're a signed invitation for attackers to spoof your top-level domain.

Jun 14, 2026MailSleuth Research
An illustration of a bridge with two misaligned halves, symbolizing a DMARC alignment failure between a sender's domain
Threat Intel
Phishing Forensics

Anatomy of a DMARC Failure: The Third-Party Sender Trap

Legitimate email from your marketing platform is failing DMARC, and adding them to your SPF record won't fix it.

Jun 14, 2026MailSleuth Research
Illustration of a hand slowly turning a valve on a data pipe, symbolizing a gradual DMARC rollout from 0% to 100%.
Threat Intel
Phishing Forensics

The DMARC 'pct' Tag Playbook: Ramping to p=reject Without Breaking Email

The 'pct' tag is your safety valve for a DMARC enforcement rollout, letting you test your policy on a small slice of traffic before going all-in.

Jun 13, 2026MailSleuth Research
An illustration of a line of falling dominoes representing SPF DNS lookups, with heavy concrete dominoes at the front an
Threat Intel
Phishing Forensics

Your SPF Record Order Is Costing You Milliseconds (And DNS Queries)

SPF records are evaluated left to right, and putting low-volume senders first creates unnecessary DNS lookups that slow down mail delivery.

Jun 13, 2026MailSleuth Research
An illustration of a door with a broken 10-keyhole lock, contrasted with a single digital keyhole representing the SPF e
Threat Intel
Phishing Forensics

Beyond 'include': Mastering SPF's Dynamic 'exists' Mechanism

Stop breaking your SPF record with includes—the 'exists' mechanism offers dynamic validation without hitting the 10-lookup limit.

Jun 13, 2026MailSleuth Research
An illustration of a domino labeled PTR starting a chain reaction in a complex, failing machine, representing the unreli
Threat Intel
Phishing Forensics

Why SPF's 'ptr' Mechanism Is a Footgun Waiting to Fire

The 'ptr' mechanism in SPF records is a deprecated, expensive, and fragile method of authentication that introduces massive performance and security risks.

Jun 12, 2026MailSleuth Research
An illustration of a crumbling, ancient stone archway representing a vulnerable SPF record, with a malicious, glowing ke
Threat Intel
Phishing Forensics

The Ghost in the TXT Record: Exploiting Dangling SPF Includes

A forgotten line in your SPF record isn't just technical debt—it's a pre-authenticated backdoor for business email compromise.

Jun 11, 2026MailSleuth Research
An abstract illustration of a single SPF query triggering a chain reaction of multiple DNS lookups, threatening to break
Threat Intel
Phishing Forensics

Microsoft 365's Hidden SPF Cost: The Nested Lookup Trap

That one `include` for Microsoft 365 in your SPF record costs you more DNS lookups than you think—here's the proof and the fix.

Jun 11, 2026MailSleuth Research
Illustration of evidence on a corkboard linked by glowing lines, all pointing to a single domain name, symbolizing domai
Threat Intel
Phishing Forensics

Weak Signals, Strong Verdict: Triaging Gray-Area Domains

When blacklists fail and auth checks pass, a domain's WHOIS data, ASN reputation, and rDNS tell the real story.

Jun 10, 2026MailSleuth Research
An editorial illustration showing a single bright teal wire being pulled straight and untangled from a large, dark, mess
Threat Intel
Phishing Forensics

The p=none Purgatory: How to Escape DMARC's Monitoring-Only Trap

A DMARC policy stuck at p=none is a security control that only watches. Here’s the playbook to de-risk the jump to quarantine and reject.

Jun 10, 2026MailSleuth Research
An illustration showing a gauge for Microsoft's Spam Confidence Level (SCL) with a needle between safe and unsafe, symbo
Threat Intel
Phishing Forensics

Microsoft's SCL Score: When to Trust It, When to Dig Deeper

Microsoft's Spam Confidence Level is a starting point, not the final word—here's how to challenge its verdict when triaging a real incident.

Jun 9, 2026MailSleuth Research
Editorial illustration of a wolf in sheep's clothing carefully herding sheep, symbolizing a threat actor building a fake
Threat Intel
Phishing Forensics

The Attacker's Pre-Flight: Building Trust on Phishing Domains

Threat actors don't just register domains; they meticulously age and authenticate them to slip past your defenses.

Jun 9, 2026MailSleuth Research
Illustration of a customs checkpoint where an email's passport has a green 'SPF PASS' stamp, but a security guard sees i
Threat Intel
Phishing Forensics

Postmortem: The Phish with Valid SPF a SEG Couldn't Stop

A valid SPF record isn't a trust signal, it's a routing check—and this common misunderstanding is how attackers bypass your SEG.

Jun 8, 2026MailSleuth Research
A close-up of a technical checklist with items like PTR, SPF, and DKIM, representing an email server pre-flight check fo
Threat Intel
Phishing Forensics

Don't Get Blacklisted on Day Zero: A Mail Server Pre-Flight Guide

Your shiny new mail server might already be blacklisted before you send a single email.

Jun 8, 2026MailSleuth Research
Illustration of a switchboard with glowing red cables for Spamhaus, Barracuda, and SURBL, symbolizing an admin triaging
Threat Intel
Phishing Forensics

Not All Blacklists Are Equal: A Triage Guide to Spamhaus, SURBL & Barracuda

An SMTP rejection isn't just an alert—it's a diagnostic puzzle. Knowing which RBL fires first tells you what broke and where to start digging.

Jun 7, 2026MailSleuth Research
An editorial illustration of a chameleon made of shifting IP addresses camouflaging itself against a server rack, repres
Threat Intel
Phishing Forensics

Anatomy of Phishing Infrastructure: Evading the Blacklist

Threat actors aren't just sending malicious emails; they're managing a dynamic, reputation-aware system designed to stay one step ahead of your RBLs.

Jun 7, 2026MailSleuth Research
An illustration showing a clean server rack next to a malfunctioning, smoking one, symbolizing the risk of a shared IP r
Threat Intel
Phishing Forensics

The Noisy Neighbor: Diagnosing Sender Reputation on Shared IPs

Your perfectly authenticated emails are getting blocked, and the reason has nothing to do with your domain's reputation. It's the IP address.

Jun 6, 2026MailSleuth Research
An illustration of a server rack with a red warning light, isolated in a dark data center, representing a blacklisted ma
Threat Intel
Phishing Forensics

Post-Incident Playbook: Your Mail Server is on a Spamhaus Blacklist

That sinking feeling when your IP is blacklisted by Spamhaus is real, but a frantic delisting request is the worst first move.

Jun 6, 2026MailSleuth Research
An abstract diagram showing the validation path for a BIMI email logo, from a DNS server through DMARC and VMC checks to
Threat Intel
Phishing Forensics

Where's My Logo? Tracing Gmail's BIMI Validation Path

Your DMARC is perfect and your SVG is valid, but the logo is missing—here's the exact validation chain Gmail follows.

Jun 5, 2026MailSleuth Research
An illustration of a technical blueprint for a certificate, with a key component glowing red to indicate a critical erro
Threat Intel
Phishing Forensics

BIMI, VMC, and the Case of the Missing Blue Checkmark

We tore down a failed BIMI deployment where a valid VMC produced no logo, and found the culprit buried deep in an ASN.1 extension.

Jun 4, 2026MailSleuth Research
An illustration of a key with broken teeth representing invalid SVG code, failing to open a large vault door symbolizing
Threat Intel
Phishing Forensics

Fixing the Invisible Logo: Your Guide to BIMI SVG Requirements

A technical playbook for debugging why your BIMI logo isn't showing, from SVG profiles to misconfigured CDN headers.

Jun 4, 2026MailSleuth Research
An illustration of an ornate key unable to enter a lock because a switch on the lock, representing a DMARC policy, is in
Threat Intel
Phishing Forensics

BIMI Record Valid, Logo Missing? Check Your DMARC Policy.

Your BIMI record is likely fine—the real reason your logo isn't showing is a DMARC policy that hasn't reached an enforcement level of quarantine or reject.

Jun 3, 2026MailSleuth Research
An illustration of an email stream being split by a railroad switch, with one path going to a finished city and the othe
Threat Intel
Phishing Forensics

When MX Priorities Collide: How MTAs Handle Same-Weight Records

Two MX records at the same priority don't create a failover; they create a chaotic, unpredictable load balancer that you never intended.

Jun 3, 2026MailSleuth Research
An illustration of a secure fortress with a forgotten, crumbling back door through which a red line of light, representi
Threat Intel
Phishing Forensics

Anatomy of a BEC Attack: The Ghost in the MX Record

A high-confidence phish landed in the CEO's inbox despite a modern SEG. The raw email headers told a story of a forgotten mail server and a fatal DNS oversight.

Jun 2, 2026MailSleuth Research
An illustration of a modern aqueduct system representing a resilient email architecture with an active, functional failo
Threat Intel
Phishing Forensics

Beyond the Backup MX: Designing Resilient Inbound Mail Architectures

That 'backup' MX record you set up and forgot about isn't business continuity; it's a security incident waiting to happen.

Jun 2, 2026MailSleuth Research
An illustration of two aqueducts, one old and one new, with water being diverted between them, symbolizing a zero-downti
Threat Intel
Phishing Forensics

The Zero-Downtime Mail Migration: A Playbook for Safely Changing MX Records

Switching email providers without losing a single message is not a fantasy; it's a matter of precise DNS management and a dual-delivery strategy.

Jun 1, 2026MailSleuth Research
An illustration of fortress blueprints shows a heavily guarded main entrance and two secret side paths, symbolizing emai
Threat Intel
Phishing Forensics

Fingerprinting the Fort: What MX Records Reveal to Attackers

Your public MX records are a detailed blueprint of your email security stack, and attackers are reading them to find a way in.

Jun 1, 2026MailSleuth Research
An illustration of an email envelope being stamped with multiple, overlapping digital seals as it passes through a serie
Threat Intel
Phishing Forensics

Decoding the Chain of Trust: How to Read Multiple DKIM Signatures

An email with two DKIM signatures isn't a mistake—it's a story of its journey, and you need to know which one matters for DMARC.

May 31, 2026MailSleuth Research
An illustration of a key representing a company's domain failing to turn a lock because of a mismatched gear representin
Threat Intel
Phishing Forensics

Postmortem: When DKIM Passes but DMARC Fails

We tore down a phishing email from a trusted vendor to show exactly why a `dkim=pass` verdict isn't enough to secure your inbox.

May 31, 2026MailSleuth Research
Illustration of two DKIM selector keys, selector1 and selector2, hanging from a cloud icon, representing Microsoft 365's
Threat Intel
Phishing Forensics

Decoding M365 DKIM Fails: selector1, selector2, and the `onmicrosoft` Trap

Microsoft 365's CNAME-based DKIM setup is clever, but its silent fallbacks and key rotation logic create subtle `dkim=fail` scenarios that stump even seasoned admins.

May 30, 2026MailSleuth Research
A fractured, antique metal key with a red tag labeled 't=y' symbolizing a DKIM test mode vulnerability in email security
Threat Intel
Phishing Forensics

An Attacker's View of DKIM: Forging Trust with Test Mode and Weak Keys

A passing DKIM signature isn't always trustworthy; attackers can exploit misconfigured test flags and weak keys to forge fully authenticated phishing emails.

May 30, 2026MailSleuth Research
An editorial illustration of a digital garden being pruned of its overgrown, zombie-like sections, representing DKIM key
Threat Intel
Phishing Forensics

Zombie DKIM Keys: How to Audit and Prune Your DNS Graveyard

Old DKIM keys from forgotten vendors are a latent security risk hiding in your public DNS, and it's time to clean them up.

May 29, 2026MailSleuth Research
An illustration of a torn blueprint for a paper airplane, symbolizing a broken SPF record that prevents proper email del
Threat Intel
Phishing Forensics

That Phish Slipped Through. Was a Broken SPF Record to Blame?

An email header's Authentication-Results isn't just noise; it's a forensic trail leading directly to the misconfigurations that let threats through.

May 29, 2026MailSleuth Research
Illustration of a secure metal door with a large question mark painted where the lock should be, symbolizing a permissiv
Threat Intel
Phishing Forensics

The Operator's Guide to Exploiting Permissive SPF Records

Overly permissive SPF records aren't a minor misconfiguration; they're an unlocked door that allows for precision email spoofing. Here's how to find and use it.

May 28, 2026MailSleuth Research
An illustration showing a precarious chain of dominoes, representing how a fragile third-party SPF 'include' can cause c
Threat Intel
Phishing Forensics

Auditing Third-Party SPF Includes Before They Break Your Mail

Your SPF record delegates trust to third parties; this playbook shows you how to audit those `include` mechanisms before they cause delivery failures.

May 28, 2026MailSleuth Research
An illustration comparing SPF softfail and hardfail using two doors. One is ajar with a caution tag; the other is locked
Threat Intel
Phishing Forensics

SPF Softfail (~all) vs. Hardfail (-all): A DMARC Operator's Calculus

A softfail is not a 'safer' SPF record; it's an ambiguous signal that undermines your DMARC enforcement and aids attackers.

May 28, 2026MailSleuth Research
An illustration showing ten glowing cables plugged into one overloaded electrical socket, with an eleventh one sparking,
Threat Intel
Phishing Forensics

Why Your SPF Fails: The 10 DNS Lookup Limit Explained

Your email deliverability depends on a single TXT record, but third-party vendors are pushing it past its breaking point.

May 27, 2026MailSleuth Research
An editorial illustration of a fishing hook baited with a glowing AI neural network, symbolizing advanced AI phishing ta
Threat Intel
Phishing Forensics

Beyond Bad Grammar: Hunting AI-Generated Phishing

The era of spotting phish by typos is over; modern attacks hide in metadata and infrastructure choices, not just prose.

May 26, 2026MailSleuth Research
An illustration showing an email server's forward DNS record being checked against its reverse DNS entry by a skeptical
Email Authentication

What Your Reverse DNS Record Tells Mail Servers About You

A missing or mismatched PTR record is one of the fastest ways to get your legitimate mail flagged as spam—a self-inflicted wound most admins don't even know they have.

May 25, 2026MailSleuth Research
Illustration of a hand tracing a glowing wire through a dark, complex server labyrinth, representing phishing header ana
Phishing Forensics

Anatomy of a Phish: Five Real Email Headers, Deconstructed

Before you click, before you panic, you read the headers. Here's what five real-world attacks look like under the microscope.

May 24, 2026MailSleuth Research
An illustration showing complex, moss-covered gears (DANE) contrasted with a simple, active railway switch (MTA-STS), sy
Email Authentication

DANE for SMTP: A Brutally Honest 2026 Reality Check

DANE promised a world without certificate authority compromises, but MTA-STS is what's actually securing your email transit today.

May 23, 2026MailSleuth Research
An illustration comparing email spoofing and impersonation with two keys. One key is made of cracked glass; the other is
Phishing Forensics

Spoofing vs. Impersonation: Why Mixing Them Up Breaks Your Playbook

Getting the distinction between a spoofed header and a clever impersonation is the one thing that determines if your incident response succeeds or fails.

May 22, 2026MailSleuth Research
An editorial illustration of a partially disassembled, intricate watch mechanism representing a complex email header bei
Phishing Forensics

Run a Phishing Tabletop Exercise Your Team Won't Hate

Most phishing drills are a waste of time. This 90-minute exercise forges real muscle memory by making email header analysis a team sport.

May 21, 2026MailSleuth Research
An editorial illustration of a phishing lure shaped like a document icon floating in dark water, attached to a glowing n
Threat Intel
Phishing Forensics

The Phishing Field Guide: 5 Lures & Their Header Tells

The most common phishing attacks aren't sophisticated; they're predictable, right down to the email headers.

May 20, 2026MailSleuth Research
An abstract editorial illustration showing email authentication protocols like SPF, DKIM, and ARC connected like constel
Email Authentication
Phishing Forensics

Gmail’s Authentication-Results Header, Translated for SOC Analysts

This single email header reveals everything Google’s mail servers know about a message’s authenticity — if you know how to read it.

May 19, 2026MailSleuth Research
Illustration of a massive, dark castle with a small, glowing door cracked open on a forgotten side tower, representing a
Email Authentication

Subdomain Spoofing Is Your Blind Spot. Here's a DMARC Fix.

Your DMARC policy is only as strong as its subdomain configuration—attackers are counting on you getting it wrong.

May 18, 2026MailSleuth Research
An abstract illustration of a single glowing thread being unraveled from a complex, dark knot, representing an OSINT inv
Threat Intel

One Phishing Header, a Dozen OSINT Pivots

A single `Received` header is more than a log entry; it's the first thread to pull that can unravel an entire threat actor's infrastructure.

May 17, 2026MailSleuth Research
An illustration of a laptop in a glass box, representing a safe phishing sandbox, with analysis tools outside the box.
Phishing Forensics

The Analyst's Weekend Project: A DIY Phishing Sandbox

Stop detonating phish on your work machine and build a dedicated, isolated lab for threat analysis this weekend.

May 16, 2026MailSleuth Research
An overhead view of a dark maze whose walls are made of QR code patterns, with a glowing teal fishing hook at its center
Phishing Forensics

Quishing Forensics: Beyond the Buzzword to the Email Header

QR code phishing bypasses URL scanners by hiding in plain sight; your defense starts with treating the image as a payload and the headers as the map.

May 15, 2026MailSleuth Research
An illustration symbolizing calendar invite phishing, where a malicious calendar event is shaped like a glowing fish hoo
Phishing Forensics
Threat Intel

The Weaponized .ics: Deconstructing Calendar Invite Phishing

Your email client's auto-add feature is a security liability that attackers are exploiting to drop malicious events directly onto your calendar.

May 14, 2026MailSleuth Research
An illustration of a tangled knot of dark cables, with a single bright red cable being pulled free from the center, symb
Phishing Forensics

Anatomy of a Phish: Decoding Quoted-Printable & Base64 Payloads

Attackers hide malicious URLs inside layers of encoding; here’s how to rip them out of a raw email header and find the phish.

May 13, 2026MailSleuth Research
An abstract illustration showing a shadowy figure attempting to break a glass pipe, which glows with a protective light,
Email Authentication

MTA-STS & TLS-RPT: Enforcing In-Transit SMTP Encryption

Opportunistic STARTTLS is a lie; MTA-STS fixes it by making inbound TLS mandatory, not optional.

May 13, 2026MailSleuth Research
An abstract illustration of an email's path through servers, with one server revealed to be a malicious, forged hop in t
Phishing Forensics

Why 'Received: from' Lies—and How to Find the Truth in Email Headers

The most dangerous line in an email header is the one you're taught to trust first.

May 11, 2026MailSleuth Research
An editorial illustration showing a complex blueprint of an email's delivery path, with successful and failed routes hig
Phishing Forensics

From .eml to Verdict: A Header Triage Workflow for Analysts

A single phish report hits your queue. This is the complete, opinionated workflow for tearing apart the .eml and delivering a confident verdict.

May 10, 2026MailSleuth Research
An illustration of a digital maze representing complex phishing infrastructure, with layers of shields obscuring the cen
Threat Intel

Phishing's New Maze: Tracing Attacks Through CDNs, IPFS, and APIs

Modern phishing infrastructure uses CDNs and decentralized storage to hide; analysts must learn to pivot through the layers to find the source.

May 9, 2026MailSleuth Research
An illustration showing a large, old brass key being replaced by a new, modern key on a complex circuit board, symbolizi
Email Authentication

A Zero-Downtime Runbook for DKIM Key Rotation

DKIM key rotation feels like swapping a jet engine mid-flight, but a methodical dual-publishing strategy makes it a routine maintenance task.

May 8, 2026MailSleuth Research
An old, rusty mail relay box stands out amidst rows of modern, glowing blue server racks, symbolizing outdated security
Threat Intel

Open Relays Are Dead. Long Live Open Relays.

You won't find them in your textbook, but open mail relays are alive and fueling modern phishing attacks. Here's how to hunt them in your email headers.

May 7, 2026MailSleuth Research
An illustration of a digital sheep whose shadow reveals the shape of a wolf, a metaphor for a lookalike phishing domain
Threat Intel
Phishing Forensics

Beyond the Bait: Hunting and Disrupting Lookalike Phishing Domains

Threat actors are weaponizing your brand with lookalike domains; here's how to turn their tactics into your own threat intelligence.

May 6, 2026MailSleuth Research
An editorial illustration showing a glowing chain with a broken link, where the energy is bridged by a translucent seal,
Email Authentication

ARC Seals the Gaps DMARC Leaves in Forwarding

Authenticated Received Chain (ARC) preserves DMARC results across complex mail flows, preventing legitimate forwarded messages from failing authentication.

May 5, 2026MailSleuth Research
A detailed blueprint of a machine, representing an email's structure, with non-standard 'X-header' components circled in
Phishing Forensics

The X-Headers Cheat Sheet: 25+ Headers That Expose Phishing Attempts

Stop guessing what cryptic X-headers mean and start using them to shut down attacks that standard authentication misses.

May 4, 2026MailSleuth Research
An illustration showing hands in gloves carefully untangling a complex knot of glowing wires, symbolizing a rapid email
Phishing Forensics
Threat Intel

BEC Triage in 30 Minutes: A Playbook for the First Responder

This is the SOC-ready Business Email Compromise playbook for stopping the bleeding and assessing the blast radius before the damage is done.

May 4, 2026MailSleuth Research
An editorial illustration showing complex email routing pipes. A central pipe has a glowing crack, representing a subtle
Email Authentication

Gmail Bulk Sender Rules: What's Tripping Up Teams Two Years Later?

DMARC alignment is passing, but deliverability is dropping. Here's what's changed in Google's bulk sender rules and where the hidden failures lie.

May 3, 2026MailSleuth Research
An abstract illustration of a digital star chart on a dark background, where one glowing line breaks pattern, symbolizin
Phishing Forensics
Email Authentication

Decoding Microsoft 365's Authentication-Results Header: A Guide for Analysts

Go beyond pass/fail to understand Microsoft's composite authentication, threat scoring, and the reason codes that reveal the full story behind every email.

May 3, 2026MailSleuth Research
An illustration comparing a broken, risky bridge of IP blocks to a strong, stable bridge representing superior email aut
Email Authentication

SPF Flattening: The Dangerous Cure for the 10-Lookup Limit

Flattening your SPF record solves the 10-lookup limit but creates its own silent, dangerous failure modes. Here's what to do instead.

May 2, 2026MailSleuth Research
An illustration of an AiTM phishing attack where a proxy bridge intercepts a user's connection, diverting it from the se
Phishing Forensics
Threat Intel

How Phishing Kits Bypass MFA and What Email Headers Reveal

Adversary-in-the-Middle phishing kits steal session tokens, not just passwords, but they leave behind subtle fingerprints in your email headers and IdP logs.

Apr 29, 2026MailSleuth Research
A digital network with holographic rubber stamps marking data packets, visualizing the concept of email header forensics
Phishing Forensics
Email Authentication

Email Header Forensics: Your Guide to Reading the Raw Evidence

User-facing email data is a suggestion; the raw header is sworn testimony from every server that touched the message.

Apr 26, 2026MailSleuth Research
Illustration of a broken wall being repaired with a strong steel gate, symbolizing fixing a DMARC policy from p=none to
Email Authentication

DMARC's Final Mile: A Pragmatic 90-Day Playbook for p=reject

Moving to p=reject is non-negotiable for stopping spoofing; this is the operational playbook to get there in 90 days without breaking legitimate email.

Apr 26, 2026MailSleuth Research
An illustration showing the complex process of BIMI, where DMARC, SVG, and VMC are gears in a machine that produces a ve
Email Authentication

BIMI, VMCs, and SVG Hell: Why Your Logo Isn't Showing Up in Inboxes

Getting your brand's logo to appear with BIMI is more than just a DNS record; it's a verification gauntlet that starts with DMARC and ends with a trademark.

Apr 26, 2026MailSleuth Research
Phishing Forensics
Email Authentication

How to Read an Email Header in 2026: A Phishing Investigator's Guide

A practical, evidence-driven guide to email header forensics in 2026 — Received chains, Authentication-Results, IP reputation, and a 5-minute SOC triage workflow.

Apr 25, 2026MailSleuth Research

Want to test a suspicious header right now?

Open the analyzer