SOP-39: Email Domain Spoofing SPF DKIM DMARC Fail Response

SOC analyst SOP for email domain spoofing via SPF DKIM and DMARC failures. Covers authentication fail analysis and look-alike domain detection.