Email Graph Analysis Detects Impersonated Suppliers When DKIM and SPF Pass

Traditional email security controls such as DKIM, SPF, and DMARC fail when an attacker has already compromised a legitimate supplier mailbox. In these cases the message arrives from the genuine server, carries a valid signature, and continues an existing thread, leaving no technical anomaly to detect.

The only reliable signal lies in the historical pattern of communication between the two parties. Mail gateway logs already contain the necessary metadata: sender, recipient, and timestamp. No message bodies or attachments are required, which simplifies legal and privacy reviews.

From Postfix logs the pairs are extracted with simple shell commands that join queue identifiers. Microsoft Exchange environments provide the same data through the Get-MessageTrace cmdlet, which should be exported daily to accumulate sufficient history.

Each external-internal address pair is profiled with counts, first and last seen dates, inbound versus outbound volume, and hourly distribution. These numbers feed five lightweight indicators:

• First contact – the address has never appeared before.
• Lookalike known – the domain is similar to a previously observed supplier domain using a split name-zone comparison that ignores hyphens.
• Dormant revived – communication resumed after more than 180 days of silence.
• One-way traffic – dozens of inbound messages with zero replies.
• Unusual hours – messages arrive outside the established working-hour pattern.

A weighted score combines the indicators so that no single weak signal triggers an alert. High scores can be surfaced as a banner inside the recipient’s mailbox or routed to the SOC for manual review.

The method breaks down for generic addresses such as info@ or sales@ and for organizations that receive fewer than several thousand external messages per day. In those environments the recommended minimum control remains a telephone callback to a known contract number before any banking details are changed.