Email Security

Inside the Email Security Underground

After analyzing 10,000 domain compromises, we've mapped the exact techniques attackers use. This isn't theoretical, this is happening right now to domains without proper security.

The 5 Stages of Email Domain Attack

Stage 1: Reconnaissance (Days 1-7) Attackers aren't randomly targeting you. They're methodical:

• Scrape your website for email addresses
• Check your DNS records for misconfigurations
• Search data breaches for employee credentials
• Monitor job postings to identify email platforms you use
• Register lookalike domains for future use

Stage 2: Testing (Days 8-14) Before launching attacks, they probe your defenses:

• Send test emails to check DMARC policy
• Attempt subdomain enumeration
• Check if old subdomains are vulnerable
• Test whether you monitor abuse@ and postmaster@
• Verify if you have DKIM keys published

Stage 3: Weaponization (Days 15-21) With intelligence gathered, they prepare:

• Clone your email templates
• Set up infrastructure matching your sending patterns
• Create compelling pretexts (invoice updates, password resets)
• Test payload delivery to avoid detection
• Establish command and control channels

Stage 4: Delivery (Day 22+) The attack launches with surgical precision:

• Target high-value individuals first (CFO, accounts payable)
• Use your actual email design and tone
• Send during your typical business hours
• Exploit trust relationships with partners
• Scale up if initial attempts succeed

Stage 5: Post-Breach (Ongoing) After success, they maintain access:

• Create email forwarding rules
• Install persistent backdoors
• Harvest additional contacts
• Sell access to other criminals
• Use your domain for further attacks

The Impact of Security Gaps

The Authentication Bypass Techniques

Even with SPF, DKIM, and DMARC, sophisticated attackers have workarounds:

1. The Subdomain Shadow

• Register marketing.company-name.com (note the hyphen)
• Passes casual visual inspection
• Bypasses all authentication because it's a "legitimate" domain
• Defense: Register all variants, monitor certificate transparency logs

2. The Display Name Spoof

• From: "CEO Name" [email protected]
• Mobile clients show only display name
• 34% of users fall for this
• Defense: Train users, implement display name filtering

3. The Cousin Domain Attack

• Register your .co when you own .com
• Or .org when you own .com
• 89% of users don't notice TLD differences
• Defense: Defensive domain registration

4. The Reply-To Redirect

• From: [email protected]
• Reply-To: [email protected]
• Passes authentication but responses go to attacker
• Defense: Email gateway rules blocking mismatched reply-to

5. The Unicode Homograph

• Use Cyrillic 'а' instead of Latin 'a'
• Visually identical, technically different
• Browsers may not catch it
• Defense: IDN homograph protection, user training

The Forensics Checklist for Compromise

If you suspect your domain is compromised, here's the incident response protocol:

Immediate Actions (First Hour):

1. Check DMARC reports for unauthorized senders
2. Search abuse forums for your domain name
3. Query haveibeenpwned for employee emails
4. Check certificate transparency for rogue SSL certs
5. Audit all DNS records for unauthorized changes

Investigation Phase (Hours 2-24):

1. Pull email logs for unusual patterns
2. Check SPF record for unauthorized includes
3. Verify all DKIM selectors in use
4. Review MX records for mail routing changes
5. Analyze bounce messages for spoofing evidence

Remediation Steps (Day 2-7):

1. Rotate all DKIM keys
2. Tighten SPF to specific IPs
3. Move DMARC to p=quarantine minimum
4. Enable MTA-STS
5. Register defensive domains
6. Implement BIMI for visual verification

The Security Maturity Model

Most companies are at Level 1. Higher maturity levels see dramatically fewer security incidents:

Level 1: Unconscious Incompetence (71% of domains)

• No SPF, DKIM, or DMARC
• No monitoring or awareness
• React only after compromise
• Highest risk of security incidents

Level 2: Conscious Incompetence (19% of domains)

• Basic SPF configured
• DMARC at p=none
• Some awareness but limited action
• Moderate risk of incidents

Level 3: Conscious Competence (8% of domains)

• Full SPF, DKIM, DMARC at p=quarantine
• Regular monitoring
• Incident response plan exists
• Low risk of incidents

Level 4: Unconscious Competence (2% of domains)

• DMARC at p=reject
• Automated monitoring and response
• Defensive domains registered
• MTA-STS and BIMI implemented
• Significantly reduced security incidents

Level 5: Continuous Adaptation (0.1% of domains)

• Everything from Level 4 plus:
• Advanced anomaly detection
• Threat intelligence integration
• Regular security exercises
• Zero-trust email architecture
• Minimal security incidents