SPF, DKIM and DMARC: Practical Guide to Detecting Email Spoofing and Phishing
The article examines how SPF, DKIM, and DMARC help determine whether an incoming email was sent from an authorized server and whether its content remained unchanged.
SPF (Sender Policy Framework) lets domain owners publish TXT records that list permitted sending IP addresses. An example record is example.com. TXT "v=spf1 ip4:192.0.2.10 -all". Receiving servers compare the sending IP against this policy. However, SPF does not validate the visible From address, allowing attackers to spoof the displayed sender while using a different domain for the SMTP envelope.
Common SPF problems include missing new mail services after infrastructure changes, multiple SPF records for one domain, exceeding the ten-DNS-lookup limit, and overly permissive policies. Forwarding can also break SPF because the sending IP changes.
DKIM (DomainKeys Identified Mail) provides cryptographic signing of selected headers and the message body. The sending server signs with a private key; the public key is published in DNS, for example at selector1._domainkey.example.com. A typical DKIM-Signature header lists the signing domain, selector, signed headers, body hash, and signature. Successful verification confirms the signed parts were not altered, yet it does not prove the sender is trustworthy.
DMARC (Domain-based Message Authentication, Reporting and Conformance) links SPF and DKIM results to the visible From domain. At least one of the two checks must pass with domain alignment. A sample DMARC record is _dmarc.example.com. TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com". Policies range from none (monitor only) to quarantine or reject. Organizations are advised to start with monitoring and gradually tighten the policy after reviewing reports.
An Authentication-Results header such as spf=pass smtp.mailfrom=bounce.example.com; dkim=pass header.d=example.com; dmarc=pass header.from=example.com indicates successful checks, yet does not rule out account compromise or malicious content sent from a legitimate domain.
Administrators should verify DNS records, align domains, analyze DMARC reports, and correct misconfigurations before enforcing stricter policies. End users should treat unexpected messages requesting urgent action or attachments with caution regardless of authentication results.
Related articles
JPAAWG 9th General Meeting to Examine AI-Driven Messaging Threats and Global Standards in Tokyo
The Japan Anti-Abuse Working Group will hold its ninth annual General Meeting on November 5-6, 2026, in Tokyo as a hybrid event focused on evolving messaging security challenges. Keynote speaker Tom Bartel from M3AAWG will address worldwide anti-abuse trends and the practical realities of AI-powered attacks and defenses. Sessions will cover the recently standardized DMARCbis specification under RFC 9989, ongoing work on DKIM2 to counter replay attacks, BIMI logo display adoption, and sender guidelines for AI-generated email summaries. Practical workshops will teach DMARC report analysis using real sample data along with related technologies such as ARC, DNSSEC, and MTA-STS. Government agencies including the National Police Agency and Ministry of Internal Affairs and Communications will also present, alongside a dedicated track on post-quantum cryptography.
Cybercriminals Use Fake WatchGuard VPN Support Site to Steal Credentials Through SEO Poisoning
Cybercriminals created a counterfeit WatchGuard support website that tricked users into entering their VPN server address, username, and password before delivering the legitimate installer. The Huntress team discovered the phishing page while investigating an October 7 incident at a managed service provider. Victims reached the site through Bing search results for terms such as watchguard vpn sll download, which redirected them to the malicious domain watchguard-vpn.net. The page mimicked the official support structure, including FAQs and a download button that led to a credential-harvesting form. The first submission always failed with an Incorrect data message, prompting victims to re-enter their details, after which the real signed client WG-MVPN-SSL_12_11_5.exe was provided. A 150-line JavaScript script silently exfiltrated the credentials via HTTP POST to a secondary domain, leaving no visible signs of compromise on the victim's system. The site, which claimed to be an independent fan site, was taken offline on October 13.
AI-Powered Drainer Scams Target IT Job Seekers via Malicious Repositories and Fake Recruiters
IT hiring has become a fertile ground for drainer scams that trick candidates into running malicious code under the guise of technical interviews. Scammers pose as recruiters on job platforms, offering roles that require downloading projects from private repositories or installing browser extensions for supposed corporate tools. These attacks often lead to crypto wallet drainers stealing funds, with victims reporting losses around $2000 in documented cases. AI tools are heavily used by attackers to generate realistic job postings, LinkedIn profiles, deepfake videos for calls, and obfuscated malicious code hidden in test assignments. Candidates are advised to inspect package.json, lock files, and CI/CD configurations before any execution and to use AI assistants like Claude for static analysis without running the code. The trend has grown amid mass layoffs and economic uncertainty, turning desperate job searches into opportunities for financial theft.
Marketplace Scraping in 2026: Why Timer-Based IP Rotation Undermines Parsers
Analysis of one full day of telemetry from MobileProxy.Space reveals how marketplace anti-fraud systems detect scrapers through session continuity and rotation patterns rather than IP reputation alone. Over 2 million IP changes were recorded across 8,878 modems, with a median of 95 unique addresses per modem. Timer-driven rotations accounted for 60.2% of all changes, and 92.2% of those intervals were exact multiples of one minute, with a median of 120 seconds. Such rigid periodicity stands out against natural mobile network behavior where address changes occur irregularly due to cell handovers or PDP context resets. The data also shows that 73.1% of address changes complete within five seconds, yet duplicate rotation commands still occur in 0.8% of link-triggered events. The recommended approach ties rotation to parser session state, recreates cookies and TLS profiles on each change, and waits for address confirmation before resuming requests.