Blogs
-
Deliverability
How URL Shortener Operators Keep Their Sending Domains Off Blacklists
URL shortener domains stay off blacklists because operators run a layered scan pipeline, split the redirect domain from the sending domain, and treat any spike in aggregate abuse signals as a hard problem that gets quarantined before reputation systems move against the brand.
-
Deliverability
How to Design Phishing Simulations That Train Employees to Spot Real Attacks
Off-the-shelf phishing templates train the wrong signal. A practical design pattern for realistic simulations that mirror AI-assisted lures and measure what matters in production.
-
DMARC
Why Recurring Microsoft 365 Changes Quietly Affect Email Authentication, And How to Watch the Trend
Microsoft announces dozens of M365 changes per month across the Message Center, Roadmap, and release notes. A handful of those quietly shift SPF, DKIM, DMARC, From-header alignment, or anti-spoofing defaults.
-
Deliverability
What Microsoft's Eviltoken-Style Session-Token Attacks Mean for Exchange Online and Entra ID Admins
Practical playbook for Exchange Online and Entra ID admins dealing with stolen-session-token attacks, with a clear-eyed map of which M365 controls actually block replay and which ones leave a quiet window open.
-
DMARC
Sending Mail from an Alias in Exchange Online: What Happens to DMARC Alignment When Send-from-Alias Goes GA
Microsoft made Exchange Online's Send-from-Alias feature generally available. Before you flip the switch, verify DKIM, SPF, and DMARC are configured per accepted domain so your alias-sent mail does not fail alignment.
-
Deliverability
Why HR/payroll QR code phishing bypasses corporate network security
When employees scan a QR code in an HR or payroll phish with a personal mobile device, every corporate network safeguard (Safe Links, URL sandboxing, gateway blocklists) is bypassed. Here is why HR themes work, where the gap is, and what actually closes it.
-
DMARC
How to stop others from sending email as your domain
Anyone can put your domain in the From header. SPF, DKIM, and DMARC each close a different part of that hole, but only the full combination actually stops spoofing.
-
DMARC
From, Return-Path, and Envelope Sender: What They Are and Why DMARC Alignment Cares
An email carries three different sender identities. DMARC alignment deliberately checks two of them against the visible From header, which is why a passing SPF or DKIM check can still leave you with a DMARC failure.
-
DMARC
Why DMARC aggregate reports stop arriving when you add a second rua endpoint
Adding a second rua tag address can silently break aggregate reports from major providers. The fix is consolidating reporting to one endpoint.
-
DMARC
Apple iCloud Header Smuggling: Why Anyone Can Send Email as tim.cook@icloud.com and Pass DMARC
Two parsing bugs in Apple iCloud SMTP pipeline let an attacker send mail as any @icloud.com address while SPF, DKIM, and DMARC all reported pass.