<?xml version="1.0" encoding="UTF-8"?>
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <url><loc>https://mailsleuth.ai/</loc><changefreq>weekly</changefreq><priority>1.0</priority></url>
  <url><loc>https://mailsleuth.ai/tools</loc><changefreq>weekly</changefreq><priority>0.9</priority></url>
  <url><loc>https://mailsleuth.ai/blog</loc><changefreq>daily</changefreq><priority>0.8</priority></url>
  <url><loc>https://mailsleuth.ai/auth</loc><changefreq>monthly</changefreq><priority>0.3</priority></url>
  <url><loc>https://mailsleuth.ai/tools/spf</loc><changefreq>monthly</changefreq><priority>0.8</priority></url>
  <url><loc>https://mailsleuth.ai/tools/dkim</loc><changefreq>monthly</changefreq><priority>0.8</priority></url>
  <url><loc>https://mailsleuth.ai/tools/dmarc</loc><changefreq>monthly</changefreq><priority>0.8</priority></url>
  <url><loc>https://mailsleuth.ai/tools/mx</loc><changefreq>monthly</changefreq><priority>0.8</priority></url>
  <url><loc>https://mailsleuth.ai/tools/ip</loc><changefreq>monthly</changefreq><priority>0.8</priority></url>
  <url><loc>https://mailsleuth.ai/tools/bimi</loc><changefreq>monthly</changefreq><priority>0.8</priority></url>
  <url><loc>https://mailsleuth.ai/tools/blacklist</loc><changefreq>monthly</changefreq><priority>0.8</priority></url>
  <url><loc>https://mailsleuth.ai/tools/domain-reputation</loc><changefreq>monthly</changefreq><priority>0.8</priority></url>
  <url><loc>https://mailsleuth.ai/blog/email-header-analysis-phishing-investigators-guide-2026</loc><lastmod>2026-04-25</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/beyond-bad-grammar-hunting-ai-generated-phishing</loc><lastmod>2026-05-26</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/how-phishing-kits-bypass-mfa-and-what-email-headers-reveal</loc><lastmod>2026-04-29</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/spoofing-vs-impersonation-why-mixing-them-up-breaks-your-playbook</loc><lastmod>2026-05-22</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/one-phishing-header-a-dozen-osint-pivots</loc><lastmod>2026-05-17</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/mta-sts-tls-rpt-enforcing-in-transit-smtp-encryption</loc><lastmod>2026-05-13</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/arc-seals-the-gaps-dmarc-leaves-in-forwarding</loc><lastmod>2026-05-05</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/a-zero-downtime-runbook-for-dkim-key-rotation</loc><lastmod>2026-05-08</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/the-analysts-weekend-project-a-diy-phishing-sandbox</loc><lastmod>2026-05-16</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/beyond-the-bait-hunting-and-disrupting-lookalike-phishing-domains</loc><lastmod>2026-05-06</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/phishings-new-maze-tracing-attacks-through-cdns-ipfs-and-apis</loc><lastmod>2026-05-09</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/what-your-reverse-dns-record-tells-mail-servers-about-you</loc><lastmod>2026-05-25</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/subdomain-spoofing-is-your-blind-spot-heres-a-dmarc-fix</loc><lastmod>2026-05-18</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/quishing-forensics-beyond-the-buzzword-to-the-email-header</loc><lastmod>2026-05-15</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/dane-for-smtp-a-brutally-honest-2026-reality-check</loc><lastmod>2026-05-23</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/dmarcs-final-mile-a-pragmatic-90-day-playbook-for-p-reject</loc><lastmod>2026-04-26</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/bec-triage-in-30-minutes-a-playbook-for-the-first-responder</loc><lastmod>2026-05-04</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/gmail-s-authentication-results-header-translated-for-soc-analysts</loc><lastmod>2026-05-19</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/the-weaponized-ics-deconstructing-calendar-invite-phishing</loc><lastmod>2026-05-14</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/when-salesforce-shatters-your-spf-the-10-lookup-limit-trap</loc><lastmod>2026-06-19</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/m-a-diligence-your-target-s-spf-record-is-a-map-of-their-hidden-risk</loc><lastmod>2026-06-19</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/dangling-spf-the-attack-vector-hiding-in-your-txt-record</loc><lastmod>2026-06-20</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/what-youre-really-authorizing-with-googles-spf-record</loc><lastmod>2026-06-20</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/postmortem-how-an-spf-permerror-let-a-bec-attack-past-our-gateway</loc><lastmod>2026-06-21</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/the-1024-bit-dkim-key-retirement-playbook</loc><lastmod>2026-06-21</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/dkims-t-y-flag-why-your-test-record-is-a-production-threat</loc><lastmod>2026-06-22</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/spf-flattening-the-dangerous-cure-for-the-10-lookup-limit</loc><lastmod>2026-05-02</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/email-header-forensics-your-guide-to-reading-the-raw-evidence</loc><lastmod>2026-04-26</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/why-received-from-lies-and-how-to-find-the-truth-in-email-headers</loc><lastmod>2026-05-11</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/why-your-spf-fails-the-10-dns-lookup-limit-explained</loc><lastmod>2026-05-27</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/spf-softfail-all-vs-hardfail-all-a-dmarc-operators-calculus</loc><lastmod>2026-05-28</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/auditing-third-party-spf-includes-before-they-break-your-mail</loc><lastmod>2026-05-28</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/the-operators-guide-to-exploiting-permissive-spf-records</loc><lastmod>2026-05-28</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/that-phish-slipped-through-was-a-broken-spf-record-to-blame</loc><lastmod>2026-05-29</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/zombie-dkim-keys-how-to-audit-and-prune-your-dns-graveyard</loc><lastmod>2026-05-29</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/an-attackers-view-of-dkim-forging-trust-with-test-mode-and-weak-keys</loc><lastmod>2026-05-30</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/decoding-m365-dkim-fails-selector1-selector2-and-the-onmicrosoft-trap</loc><lastmod>2026-05-30</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/postmortem-when-dkim-passes-but-dmarc-fails</loc><lastmod>2026-05-31</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/decoding-the-chain-of-trust-how-to-read-multiple-dkim-signatures</loc><lastmod>2026-05-31</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/fingerprinting-the-fort-what-mx-records-reveal-to-attackers</loc><lastmod>2026-06-01</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/the-zero-downtime-mail-migration-a-playbook-for-safely-changing-mx-records</loc><lastmod>2026-06-01</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/beyond-the-backup-mx-designing-resilient-inbound-mail-architectures</loc><lastmod>2026-06-02</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/anatomy-of-a-bec-attack-the-ghost-in-the-mx-record</loc><lastmod>2026-06-02</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/when-mx-priorities-collide-how-mtas-handle-same-weight-records</loc><lastmod>2026-06-03</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/bimi-record-valid-logo-missing-check-your-dmarc-policy</loc><lastmod>2026-06-03</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/fixing-the-invisible-logo-your-guide-to-bimi-svg-requirements</loc><lastmod>2026-06-04</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/bimi-vmc-and-the-case-of-the-missing-blue-checkmark</loc><lastmod>2026-06-04</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/wheres-my-logo-tracing-gmails-bimi-validation-path</loc><lastmod>2026-06-05</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/post-incident-playbook-your-mail-server-is-on-a-spamhaus-blacklist</loc><lastmod>2026-06-06</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/the-noisy-neighbor-diagnosing-sender-reputation-on-shared-ips</loc><lastmod>2026-06-06</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/anatomy-of-phishing-infrastructure-evading-the-blacklist</loc><lastmod>2026-06-07</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/not-all-blacklists-are-equal-a-triage-guide-to-spamhaus-surbl-barracuda</loc><lastmod>2026-06-07</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/dont-get-blacklisted-on-day-zero-a-mail-server-pre-flight-guide</loc><lastmod>2026-06-08</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/postmortem-the-phish-with-valid-spf-a-seg-couldnt-stop</loc><lastmod>2026-06-08</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/the-attackers-pre-flight-building-trust-on-phishing-domains</loc><lastmod>2026-06-09</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/microsofts-scl-score-when-to-trust-it-when-to-dig-deeper</loc><lastmod>2026-06-09</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/the-p-none-purgatory-how-to-escape-dmarcs-monitoring-only-trap</loc><lastmod>2026-06-10</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/weak-signals-strong-verdict-triaging-gray-area-domains</loc><lastmod>2026-06-10</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/microsoft-365s-hidden-spf-cost-the-nested-lookup-trap</loc><lastmod>2026-06-11</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/the-ghost-in-the-txt-record-exploiting-dangling-spf-includes</loc><lastmod>2026-06-11</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/why-spfs-ptr-mechanism-is-a-footgun-waiting-to-fire</loc><lastmod>2026-06-12</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/beyond-include-mastering-spfs-dynamic-exists-mechanism</loc><lastmod>2026-06-13</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/your-spf-record-order-is-costing-you-milliseconds-and-dns-queries</loc><lastmod>2026-06-13</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/the-dmarc-pct-tag-playbook-ramping-to-p-reject-without-breaking-email</loc><lastmod>2026-06-13</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/anatomy-of-a-dmarc-failure-the-third-party-sender-trap</loc><lastmod>2026-06-14</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/dmarcs-dirty-secret-exploiting-relaxed-alignment-for-domain-spoofing</loc><lastmod>2026-06-14</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/decoding-dmarc-failures-a-forensic-guide-to-rua-ruf-reports</loc><lastmod>2026-06-15</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/dmarc-stuck-at-p-none-an-rua-triage-playbook</loc><lastmod>2026-06-15</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/postmortem-how-a-botched-esp-migration-got-our-domain-blacklisted</loc><lastmod>2026-06-16</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/shared-ip-shared-problem-when-m365-lands-on-an-obscure-rbl</loc><lastmod>2026-06-17</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/abusing-ip-reputation-a-red-teamers-guide-to-rbl-evasion</loc><lastmod>2026-06-17</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/your-ptr-record-is-lying-that-s-why-spamhaus-blocked-you</loc><lastmod>2026-06-18</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/from-eml-to-verdict-a-header-triage-workflow-for-analysts</loc><lastmod>2026-05-10</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/anatomy-of-a-phish-five-real-email-headers-deconstructed</loc><lastmod>2026-05-24</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/gmail-bulk-sender-rules-whats-tripping-up-teams-two-years-later</loc><lastmod>2026-05-03</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/open-relays-are-dead-long-live-open-relays</loc><lastmod>2026-05-07</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/anatomy-of-a-phish-decoding-quoted-printable-base64-payloads</loc><lastmod>2026-05-13</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/the-phishing-field-guide-5-lures-their-header-tells</loc><lastmod>2026-05-20</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/decoding-microsoft-365s-authentication-results-header-a-guide-for-analysts</loc><lastmod>2026-05-03</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/bimi-vmcs-and-svg-hell-why-your-logo-isnt-showing-up-in-inboxes</loc><lastmod>2026-04-26</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/the-x-headers-cheat-sheet-25-headers-that-expose-phishing-attempts</loc><lastmod>2026-05-04</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
  <url><loc>https://mailsleuth.ai/blog/run-a-phishing-tabletop-exercise-your-team-wont-hate</loc><lastmod>2026-05-21</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>
</urlset>