SignalHunt
← All rules

EMAIL-8002

high

Email Delivered Despite Failing DMARC Authentication

Detects an inbound email that failed DMARC authentication (the sending domain's own policy says this message shouldn't be trusted) but was delivered to the mailbox anyway - a spoofed-sender email that got through instead of being quarantined or rejected.

T1656

Detection logic

{
  "detection_type": "selection",
  "selection": {
    "direction": "inbound",
    "action": "delivered",
    "dmarc_result": "fail"
  }
}

Log source: category=email_gateway · Event ID(s): email_delivered

Required log fields

  • direction
  • action
  • dmarc_result
  • sender_domain

Enabling this in your environment

Where: Email gateway DMARC enforcement policy

Set the gateway's DMARC-fail action to quarantine or reject rather than "deliver and tag" (Microsoft Defender for Office 365 anti-phish policy action, Proofpoint/Mimecast DMARC enforcement setting). If the action is left at "deliver," this rule will fire constantly and provide no real protection on its own.

A message can pass SPF or DKIM individually and still fail DMARC if alignment fails (e.g. the From: header domain doesn't match the domain that actually authenticated) - log dmarc_result specifically, not just spf_result/dkim_result.

False positives

  • A legitimate sender whose domain has a genuinely broken or overly strict DMARC record (mailing-list forwarding is a common cause of false DMARC failures)
  • A newly onboarded vendor domain that hasn't finished DMARC/SPF/DKIM setup yet

References