SOP-39: Email Domain Spoofing SPF DKIM DMARC Fail Response

Rudra Verma, Senior Security Architect & Researcher · 2026-07-18

Email spoofing (T1566.002 / T1586.002) involves forging the From: header to impersonate a trusted domain — either your own organisation or a business partner. SPF, DKIM, and DMARC are the three authentication pillars that detect spoofing. This SOP covers two patterns: direct domain spoofing (your own domain fails SPF/DKIM) and look-alike domain impersonation (cousin domain such as cyberhawkthreatinte1.com with no SPF failure).

DMARC policy weaknesses (p=none) are the root cause of most domain spoofing reaching inboxes. Any SPF fail or DKIM fail against your own domain delivered to internal users indicates a DMARC gap that must be remediated.

☰ Table of Contents

01 Background 02 Identification 03 Containment 04 Eradication 05 Escalation

🛠

01 — BACKGROUND

TECHNIQUE OVERVIEW

Email Authentication Architecture

T1566.002 / T1586.002

SPF (Sender Policy Framework) verifies that the sending mail server IP is authorized for the sender domain. DKIM (DomainKeys Identified Mail) verifies the email was signed by the sending domain's private key. DMARC ties both together and specifies the policy (none, quarantine, or reject) when either check fails. A DMARC policy of p=none means emails that fail SPF and DKIM are still delivered — this is the most common spoofing enabler.

Field	Value
MITRE Technique	T1566.002 — Spearphishing Link / T1586.002 — Email Accounts
Log Sources	EmailEvents (Defender XDR), OfficeActivity, CommonSecurityLog (mail gateway)
Key Fields	SenderFromDomain, AuthenticationDetails (SPF/DKIM/DMARC result), DeliveryAction
High-Risk Scenarios	Own domain SPF fail, DMARC p=none, look-alike domain within 2 Levenshtein distance
Detection Priority	HIGH if targeting executives or finance (BEC vector)

🔍

02 — IDENTIFICATION

2 INDICATORS

▶ Investigation Workflow

SPF / DKIM / DMARC Authentication Failure Analysis

T1566.002

WHY CHECK

EmailEvents stores the full authentication result string containing SPF, DKIM, and DMARC verdicts. A combined SPF fail + DKIM fail against your own domain means the email is definitively spoofed. A single fail may indicate a misconfigured legitimate sender (marketing tool, third-party SaaS) that needs to be added to the SPF record.

📍 Portal Navigation — Defender XDR Advanced Hunting

security.microsoft.com› Hunting› Advanced Hunting

1Navigate to Advanced Hunting. Replace YOUR_DOMAIN in the KQL with your organisation's domain (e.g., contoso.com).
2Review AuthenticationDetails column — look for spf=fail and dkim=fail in the same row to confirm direct domain spoofing.
3Check SenderIPv4: if the sending IP is a known mail provider (Google, Microsoft, SendGrid) it may be a misconfigured legitimate service rather than spoofing.
4Check if the RecipientEmailAddress is an executive, finance team, or HR member — BEC targeting requires immediate escalation regardless of delivery status.
5Cross-reference the sending domain against your DMARC reporting data: Security → Email & Collaboration → Reports → DMARC reports.

Auth Result	Meaning	Action
spf=fail dkim=fail	Direct domain spoof — email not from authorised sender	ESCALATE + DMARC fix
spf=fail dkim=pass	DKIM passes (legitimate tool?) but IP not in SPF record — SPF record gap	Add sender to SPF
spf=pass dkim=fail	IP authorized but DKIM signing missing — key rotation or config issue	Investigate DKIM config
dmarc=fail p=none	DMARC failed but policy is none — email still delivered	Escalate to p=quarantine

DETECTS: Inbound emails to your domain that failed SPF or DKIM authentication — grouped by sender domain to identify spoofing campaigns and misconfigured legitimate senders.

KQL — Defender XDR Advanced Hunting (EmailEvents)

let YourDomain = "YOUR_DOMAIN.com"; EmailEvents | where Timestamp > ago(24h) | where RecipientEmailAddress endswith strcat("@", YourDomain) | where AuthenticationDetails has "spf=fail" or AuthenticationDetails has "dkim=fail" | summarize EmailCount = count(), Recipients = make_set(RecipientEmailAddress, 10), SenderIPs = make_set(SenderIPv4, 5), DeliveryActions = make_set(DeliveryAction) by SenderFromAddress, SenderFromDomain, AuthenticationDetails | order by EmailCount desc

DETECTS: SPF and DKIM failures in Splunk mail gateway logs — identifies spoofed inbound emails targeting your domain and groups by sender and failure type.

SPL — Splunk

index=* sourcetype=mail_gateway (spf_result=fail OR dkim_result=fail) recipient_domain="YOUR_DOMAIN.com" | stats count as email_count, values(sender) as senders, values(recipient) as recipients, values(src_ip) as src_ips by sender_domain spf_result dkim_result | sort -email_count

If DMARC is set to p=none, this is an urgent remediation item. Move to p=quarantine first (monitor for legitimate mail being caught), then to p=reject once you confirm all authorized senders are in your SPF record and signing with DKIM.

Look-Alike Domain Detection

T1586.002

WHY CHECK

Look-alike domains (typosquatting, homograph attacks) pass SPF and DKIM because they are legitimately registered domains — just visually similar to yours (e.g., c0mpany.com vs company.com). These bypass authentication-based detection and must be caught by display name similarity analysis and domain age checks.

📍 Portal Navigation — Defender XDR Threat Explorer

security.microsoft.com› Email & Collaboration› Explorer → Phish

1In Threat Explorer → Phish, filter by Sender domain using a substring search for a portion of your domain name.
2Review results for domains with 1–3 character differences: swapped letters, added numbers, different TLDs (.net instead of .com).
3Run the KQL below to find inbound emails where the display name contains your company name but the sending domain does not match your domain.
4Check the look-alike domain registration date via a WHOIS lookup — recently registered domains (under 30 days) targeting your industry are almost certainly malicious.
5If the look-alike domain was used to target finance or executives, treat as active BEC attempt and escalate.

DETECTS: Emails where the sender display name contains your company name but the sending domain does not match your authorised domain — classic BEC display name spoofing and look-alike domain impersonation.

KQL — Defender XDR Advanced Hunting

let YourDomain = "YOUR_DOMAIN.com"; let YourCompanyName = "YOUR COMPANY NAME"; EmailEvents | where Timestamp > ago(48h) | where SenderDisplayName has YourCompanyName and SenderFromDomain != YourDomain | project Timestamp, SenderFromAddress, SenderFromDomain, SenderDisplayName, RecipientEmailAddress, Subject, DeliveryAction, AuthenticationDetails | order by Timestamp desc

DETECTS: Display name spoofing in Splunk — finds emails claiming to be from your organization but sent from external domains.

SPL — Splunk

index=* sourcetype=mail_gateway sender_display_name="*YOUR COMPANY*" NOT sender_domain="YOUR_DOMAIN.com" | table _time sender sender_display_name recipient subject src_ip | sort -_time

BEC (Business Email Compromise) using look-alike domains targets finance teams requesting wire transfers. If any spoofed email reached a finance team member and involves a payment request, immediately contact that employee by phone (not email) and freeze any pending wire transfers.

🚫

03 — CONTAINMENT

IMMEDIATE ACTION

Verdict & Escalation Decision

DECISION GATE

▶ Triage Verdict — Select One

CONFIRMED Own domain spoofed (spf=fail + dkim=fail) AND delivered to finance/exec → ZAP, block sender, notify targeted user by phone, check for wire transfer requests

PARTIAL Look-alike domain detected, email delivered, no action taken by recipient → ZAP copies, block sender domain, user awareness comms

FALSE POSITIVE SPF fail from known third-party SaaS (marketing tool, CRM) → Add sender IP to SPF record include, no malicious intent

Block Spoofed Sender & ZAP Emails

CONTAINMENT

1Block the spoofed sender domain: Threat Policies → Anti-spam → Block list → add sender domain.
2ZAP all copies of the spoofed email: Threat Explorer → All email → filter by sender → Actions → Move to deleted items.
3If DMARC is p=none, immediately escalate to the email platform team to update to p=quarantine.
4If a look-alike domain is involved, submit it to Microsoft for Defender impersonation protection and consider a domain takedown via your legal team if it is actively being used for BEC.

🗑

04 — ERADICATION

CLEANUP

DMARC Hardening & Email Authentication Remediation

ERADICATION

1Review and update your SPF record: add any missing authorized sending IPs (CRM, marketing tools, HR SaaS). Maximum SPF DNS lookups is 10 — do not exceed this.
2Verify DKIM keys are active for all sending domains: Microsoft 365 Admin → Settings → Domains → [domain] → DKIM.
3Update DMARC policy from p=none to p=quarantine (DNS TXT record v=DMARC1; p=quarantine; rua=mailto:[email protected]).
4Enable Defender for Office 365 Impersonation Protection for all executive and finance team email addresses: Threat Policies → Anti-phishing → Enable impersonation protection.
5Monitor DMARC aggregate reports over the following 7 days to confirm no legitimate mail is being quarantined before moving to p=reject.

Eradication Complete When

All spoofed email copies ZAP-purged confirmed in EmailEvents
Sender domain added to anti-spam block list
DMARC policy updated to p=quarantine minimum
SPF record updated to include all legitimate senders
Targeted users (exec/finance) notified and warned about BEC risk

📢

05 — ESCALATION

ESCALATION PATHS

ES1

Escalation Matrix

ESCALATION

Condition	Severity	Action	Notify
BEC: finance/exec targeted, payment request	SEV1	Phone call to target, freeze transfers, IR	SOC Lead → CISO → Finance Manager
Own domain spoofed, DMARC p=none, delivered	SEV2	ZAP, DMARC update, user comms	SOC Lead → Email Platform Team
Look-alike domain, no payment request	SEV3	ZAP, block domain, awareness email to org	SOC Lead
Third-party SaaS SPF fail (legitimate sender)	INFO	Update SPF record, no incident	Email Platform Team only

Stay Threat-Ready

Follow CyberHawk Threat Intel for daily SOC analyst playbooks, detection engineering guides, and threat intelligence.

📺 YouTube 🎤 TikTok 🐦 X / Twitter 📡 Telegram

All SOPs Blog Web App (Free)

They can't exploit you if you are the Exploit.