Blogs
-
DMARC
How the AiTM Reverse-Proxy Worm Self-Propagates Through Google Workspace Tenants (and What Actually Stops It)
AiTM reverse-proxy phishing captures Google Workspace session cookies even with 2FA on. Here is how the worm self-propagates inside one tenant, and which layered controls actually break the chain.
-
DMARC
Which Downstream Accounts Need Checking After a Mailbox Takeover Is Resolved?
A password reset does not close a mailbox-takeover incident. Here is the checklist of OAuth grants, persistent mailbox access, and downstream accounts to verify before signing the ticket off.
-
DMARC
How to Detect Vendor Cancellation Email Scams That Pass SPF, DKIM, and DMARC
Vendor cancellation scams pass SPF, DKIM, and DMARC by design. Here is what to look for in the message and the verification workflow to run before anyone clicks.
-
DMARC
What to Do When Your DMARC Reporting Service Provider Shuts Down
A practical migration playbook for when your hosted DMARC reporting service goes away - archive the raw XML, swap the rua tag, and keep trend visibility continuous.
-
Deliverability
Why Recipients Reject Legitimate Emails With a Generic Local Part
Senders keep getting bounced or silently dropped because their address starts with "email", "info", "noreply", or another generic word. Here is what is actually happening, why it is not an SPF/DKIM/DMARC problem, and how to localize the cause.
-
DMARC
Why DMARC on your main domain does not cover your country-code TLD
A single DMARC record at one apex domain does not protect sibling or country-code domains. Here is how to find the unprotected zones and close the gap.
-
Deliverability
Microsoft 365 Mailbox and Calendar Audit Logs: Compliance Investigator Guide
A practical map of Microsoft 365 mailbox and calendar audit log sources for compliance investigators, with PowerShell snippets and retention notes.
-
Deliverability
Why Recipients Reject Legitimate Emails With a Generic Local Part
Senders keep getting bounced or silently dropped because their address starts with "email", "info", "noreply", or another generic word. Here is what is actually happening, why it is not an SPF/DKIM/DMARC problem, and how to localize the cause.
-
DMARC
How Safe-Sender Lists Silently Override Your DMARC Reject Policy
Safe-sender lists can bypass DMARC authentication after it has already passed, delivering emails that your reject policy should have blocked.
-
Deliverability
How to Respond When Your Microsoft 365 Account Has Been Hacked
A step-by-step incident response sequence for Microsoft 365 account compromise. Covers session revocation, password reset, app consent review, audit logging, and how to tell if the attacker sent email as your domain.