Analytics BIOC Informational
✕

Suspicious DMARC result

The email has a suspicious DMARC result of either fail or none, which may indicate a potential domain misconfiguration or spoofing.

Module:
Email Security
Licensed by:
Email Security
Data source:
Microsoft 365 Emails
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Impersonation (T1656)
Detector tags: Spoofing
Attacker's goals:

Impersonate internal users or familiar individuals. Trick users into clicking on malicious links or attachments.

Investigative actions:

Check the email address for any unusual spellings. Check the email address for any missing letters. Check the reason DMARC didn't pass and the action. Check if the email was delivered to the recipients based on the action taken, even though DMARC did not pass. Verify whether the sender's IP address has appeared in different log sources before and its reputation. If the message contains attachments or links, scrutinize them for any suspicious indications. Monitor further actions taken, such as file downloads or access to potentially malicious links.

Test period:
N/A (single event)
Deduplication:
1 Day
3 variations:
  • DMARC deviation from historically compliant domain Informational
  • DMARC failure bypassed domain policy Informational
  • DMARC failed with non-enforcing policy Informational