Email security & phishing analysis

When it applies

Two authorized jobs (tradecraft-scope-roe): (a) defensive — dissect a reported phishing email or BEC attempt, extract IOCs, and recommend tenant controls (defense-* context); (b) offensive — assess whether an in-scope domain can be spoofed (SPF/DKIM/DMARC posture) as findings for a report. Sending simulated phishing is a separate, pentest-only track — load social-eng-methodology first and never run it against a bug-bounty target. Never re-deliver malicious samples to real users, and never mass-test third-party domains.

Why it works

Spoofing succeeds when a domain's authentication records are missing, weak (~all, p=none), or misaligned — the receiving server then has no cryptographic reason to reject a forged From. And even with perfect auth, the display name and Reply-To are unauthenticated, which is what BEC abuses. Reading full original headers exposes the truth the mail client hides.