Blogs
-
DMARC
How Attackers Use Your Own M365 Tenant Branding to Bypass 2FA
Trusted sender abuse lets attackers send phishing from sources your M365 tenant already trusts, using your own tenant branding to harvest credentials in real time. Here is how the attack works and what helps.
-
DMARC
How to Interpret DMARC Aggregate Reports: What the Data Actually Tells You
DMARC aggregate reports show you what receivers see when they check your email. Here is how to read every major section and what to do with what you find.
-
DMARC
Why Phishing Feels Safer in a Shared Ops Mailbox (and How to Fix It)
Shared operational mailboxes make phishing emails feel more trustworthy simply because of where they sit. Here is why the context does the social engineering for attackers, and what to do about it.
-
DMARC
Why Your Emails Fail DMARC Alignment at Third-Party Receivers (Even When Your Records Look Correct)
When a third-party receiver rejects your email citing DMARC alignment, the problem is usually in how the receiver interprets your authentication records, not in the records themselves. Here is what alignment actually means from the receiver side and how to diagnose and fix it.
-
DMARC
What Happens When Your Own DMARC Monitoring Fails to Catch a Subdomain SPF Gap
A DMARC expert was caught by their own monitoring when a subdomain's missing SPF record silently blocked legitimate mail after p=reject was enabled. Here is what happened and how to detect it before it breaks your own mail.
-
DMARC
Why Your Emails Bounce With DMARC Failures When Both Sender and Receiver Use Proofpoint
When two organizations both route mail through Proofpoint, legitimate messages can bounce with DMARC alignment failures even when SPF and DKIM are correct on both sides. Here is what causes it and how to fix it.
-
DMARC
Why Proofpoint Blocks Legitimate Email Citing DMARC (Even When SPF and DKIM Pass)
Organizations using Microsoft 365 or Google Workspace sometimes find their legitimate email suddenly blocked by Proofpoint-protected domains, with rejections citing DMARC failures. Here is what is actually happening and how to fix it.
-
DMARC
How APT Groups Use Legitimate Cloud Infrastructure for Email Attacks (And How to Detect Them)
APT groups increasingly send phishing from AWS, Azure, and Google Cloud instead of rogue servers. Here is how the attacks work and what your DMARC aggregate reports reveal about them.
-
DMARC
Why AI Phishing Bypasses Static Email Defenses and What Actually Helps
AI-generated phishing defeats signature-based and URL-reputation email filters by rotating content, sender identities, and link destinations dynamically. Here is why static defenses struggle and what email authentication adds that filters cannot replicate.
-
DMARC
Why Setting DMARC p=reject Without Monitoring Tools Is a Fast Way to Break Email Delivery
Moving to DMARC p=reject without knowing which legitimate senders are misaligned is how domains go silent. Here is what breaks, why monitoring before rejecting matters, and how to move safely.