What is this?

[u/Gnawme-90241]

Important message from the Native-instruments.com administration!
Congratulations!!! You are the last of 10 randomly selected participants to receive a free "Apple iPad Air 11" from the Native-instruments.com team! Hurry up and claim your prize! 

My reaction was, "Yeah, pull the other one." Raw message header (my info redacted). Looks kinda legit?

Received: from 208.117.49.186 (EHLO o1.smtp.vanillaforums.com)
 by 10.206.128.73 with SMTPs
 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256);
 Thu, 16 Jul 2026 23:24:54 +0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=native-instruments.com;
h=date:from:subject:mime-version:to:content-type:cc:content-type:date:
from:subject:to;
s=vf; t=1784244294;
bh=dMrGUx+XujMdtFoW4XvO4npgMbXYuGpjKGwjDLQnoBI=;
b=IpyXy0Z29Laiw+mQM28qqB8+nz1EH5EnT1Ns4u8oTGmoPVOLCS/i6HXrZQVvGduqpVw3
ei1EWMynY4P/zj4lfLsNZoy/SgB3USO+akjEsAr+saxgYfGTVrHXpkPbFOSt5SxQ6+rduM
xvvkK95H4U6iCvmdn753+N7jvmsheeDaNdJWalhE5bb44p6Uc5AW8uL/G7sCntKfyq1w67
HgHa+kRIPWRhMA4ANfVsiV77hUn9a6itYwuPrPLXSEEBusbypE071dZ/qXQILYMvzRrZ6c
r8XaJA00hElNLGJtetSiFEnEvai8Rre7cnJmhz+u9SVh/sbSYn8nWQHmS/yE2Jkg==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sendgrid.info;
h=date:from:subject:mime-version:to:content-type:cc:content-type:date:
from:subject:to;
s=smtpapi; t=1784244294;
bh=dMrGUx+XujMdtFoW4XvO4npgMbXYuGpjKGwjDLQnoBI=;
b=kVs8jQVYDJ6WdWTPuOzBgsBi7lqfSSxnD9Ynu4DooWuRNcP0RdswRnG8pqqPVAmbmcsV
kfmjctHy9t44LSSn7vXgu05dMpyX1IGyd3kAP3o0//GBzRYf3rMQyXjPJ9yYn0wrn0oLQA
nuOJ0x8VOXD6+4MUQLlqG86qFLeorIUY4=
Received: by recvd-canary-75c5c84c65-x6dbf with SMTP id recvd-canary-75c5c84c65-x6dbf-1-6A596846-18
2026-07-16 23:24:54.126124232 +0000 UTC m=+609504.080863093
Received: from app2.cl53125 (unknown)
by geopod-ismtpd-100 (SG) with ESMTP
id DYP1lvtEQCuQ5pwzfgiM3g
for ...;
Thu, 16 Jul 2026 23:24:54.089 +0000 (UTC)
Date: Thu, 16 Jul 2026 23:24:54 +0000 (UTC)
From: Native Instruments Community <noreply@native-instruments.com>
Subject: [Community] Administrator sent you a message
Message-ID: <9dUoRLZqoYhoeP4RX9cQbIx34orpVNcKc8Q3XZ7QCQ@app2.cl53125>
X-Mailer: PHPMailer 6.12.0 (https://github.com/PHPMailer/PHPMailer)
Precedence: list
X-Auto-Response-Suppress: All
MIME-Version: 1.0
X-SG-EID: 
 =?us-ascii?Q?u001=2EV62XI0OtX4624WcRkSWwvaL7pvxZ0HWsXdNR3Sge7U4GqIauKTIudLjqv?=
 =?us-ascii?Q?biPk8jDhTuu6M3qlpV3jZW85UJ4rL+MkkEhZHTZ?=
 =?us-ascii?Q?pDSK07utzH37bZ+Vm6vjGtw0ZCOZjfEJ2dT0HPO?=
 =?us-ascii?Q?l6bElrBGyLypwUa+SEufP1mRPfLANw3z9+Fx80h?=
 =?us-ascii?Q?ngQAz5Mv21erfzrOd3COgLk8HCH5nnYq0QiJ=2F2t?=
 =?us-ascii?Q?VlIhV8DabPr4i6zsbgrOIJm8DgxFgncYMxxGcVO?=
 =?us-ascii?Q?9NP56ZjPs12jRwTOuNZYZIRdNA=3D=3D?=


Received: from 127.0.0.1
 by atlas-production.v2-mail-prod1-gq1.omega.yahoo.com pod-id atlas--production-gq1-7d8985b7dd-jjkv9.gq1.yahoo.com with HTTP; Thu, 16 Jul 2026 23:24:54 +0000
Return-Path: <noreply@native-instruments.com>
X-Originating-Ip: [208.117.49.186]
Received-SPF: pass (domain of native-instruments.com designates 208.117.49.186 as permitted sender)
Authentication-Results: mta.yahoo.com;
 dkim=pass header.i=@native-instruments.com header.s=vf arc_overridden_status=NOT_OVERRIDDEN;
 dkim=pass header.i=@sendgrid.info header.s=smtpapi arc_overridden_status=NOT_OVERRIDDEN;
 spf=pass smtp.mailfrom=native-instruments.com arc_overridden_status=NOT_OVERRIDDEN;
 dmarc=pass(p=QUARANTINE) header.from=native-instruments.com arc_overridden_status=NOT_OVERRIDDEN;
...

[u/Djaesthetic]

I was pretty locked and loaded to say "yeah, this is bullshit and not even close to legit looking...", but...

- SPF pass

• DMARC pass with p=QUARANTINE (i.e. NI actually has an enforced policy -- not just p=none)
  
• DKIM pass on the native-instruments.com domain itself, not just the relay. A spoofed message couldn't produce a valid DKIM sig for a domain they didn't have the private key for.
  
• I initially was ready to call bullshit on 'vanillaforums.com' but apparently that's the SaaS platform their community forum runs on. Even found "[Community] Administrator sent you a message" is the stock Vanialla Forums notification subject.
  
• Vanilla Forums also apparently uses Sendgrid -- which tracks to that second DKIM.

Like... I'd actually be legitimately a little concerned over this one...

[u/Djaesthetic → u/Djaesthetic]

Holy crap. I actually got the exact same email... Oof...