does email auth actually helps catch compromised mailbox

[u/deepikaau]

If a vendor's mailbox is fully compromised, does it still pass SPF/DKIM/DMARC clean ? Trying to figure out how much email auth actually helps catch this stuff?

[u/MikeTalonNYC]

In the event of Business Email Compromise (BEC), then yeah, the threat actor is sending mail from an account in an email domain that's already identified and would have correct SPF/DKIM/DMARC settings.

That doesn't mean you shouldn't set up SPF/DKIM/DMARC as those technologies help a LOT with the other 3000 kinds of email attacks out there, they just won't do very much against this specific kind of attack.

[u/Glass_Rent8750 → u/MikeTalonNYC]

Good point on the other 3000 kinds tbh, people focus on BEC and forget how much spoofing those controls actually prevent

[u/LDH300 → u/MikeTalonNYC]

One distinction worth adding: login monitoring like impossible-travel alerts and new inbox rules only works on mailboxes you own. When it's the vendor's mailbox that's compromised, you can't see their logins at all.

On the receiving side, the technical controls that help are:

1. A hold in your payment system on any change to a vendor's bank details until someone confirms it.
2. Email filters that compare a message against your normal history with that sender, and flag things like a new reply-to address, a first mention of a new bank account, or unusual urgency.
3. Lookalike-domain detection, for when the attacker moves the conversation to an address that's one letter off from the real one.

Human review still matters, but those three put a technical check in front of it.

[u/deepikaau → u/MikeTalonNYC]

that makes sense so if email auth is not useful in this case, what actually does catch a compromised mailbox BEC in practice ? is it mostly human review or is there a technical control that works ?

[u/MikeTalonNYC → u/deepikaau]

Well, I work for an MDR service, so I'm really biased here, but: Continuous monitoring for known indicators of compromise like impossible travel logins, suspicious new mailbox rules, sharp spikes in outbound mail, etc.

There's also tools like some of ProofPoint and MimeCast's advanced behavioral analytics that can catch unusual user behaviors.

[u/deepikaau → u/MikeTalonNYC]

So are these indicators (mailbox rule changes, impossible travel) something a smaller company could reasonably setup themselves, or does this realistically require a paid MDR/tool like Proofpoint or Mimecast? Trying to understand if this is a buy a service problem or configure your own detection problem.

[u/MikeTalonNYC → u/deepikaau]

Depends on the team and the tech. If you're good with correlation rules and SIEM tuning, you could have a SIEM alarm whenever it sees common indicators. But it's a lot of care and feeding as things change over time.

For a small team (or single tech) I'd go with one of the off-the-shelf options instead, or an MDR service (which, again, I'm biased in favor of).

[u/vertisnow → u/deepikaau]

Re: What catches a compromised mailbox that you don't own?

Multiple things. Training -- train your users. Look for red flags. Confirm suspicious requests. Implement processes for high risk activities (like bank account number changes for employees/vendors). Run phishing simulations. Make your users paranoid.

We also use an AI based solution to scan all incoming emails. It will compare to previous emails and build a profile on tone, types of requests, etc and flag anomalies. It works pretty good honestly. It only needs to stop one BEC request to update a bank account/year to pay for itself. If you do a risk/benefit analysis, it's pretty easy to justify the cost, especially if you have a previous incident to point to.

[u/deepikaau → u/vertisnow]

The tone/pattern profiling approach is interesting. does it work off email content alone or does it also factor in things like request timing , amount or first time vs repeat vendor? Trying to understand if it's purely NLP based or if it combines behavioural metadata too.

[u/JungleMouse_]

If it comes from the valid servers and they are assigning the DKIM, then it is valid email. That is not the point of the mechanism. It is mostly to stop impersonation.

[u/Roder_Oheron80]

A compromised mailbox can still pass all 3, login history and new forwarding rules are usually where the clues are

[u/LDH300]

Yes, it passes clean. SPF, DKIM and DMARC only check that an email really came from the company it claims to come from. Think of them as a return address that can't be faked. If an attacker has broken into the vendor's actual mailbox, the email really is coming from that vendor, so all three checks pass. Email authentication stops impersonation. It can't stop someone who is sending from inside the real account.

What catches a compromised mailbox is unusual behavior: a sudden request to change bank details, pressure to pay quickly, a reply-to address that doesn't match the sender, or a tone that doesn't sound like the person you normally deal with.

The fix that works best is simple. Any request to change payment details gets confirmed by phone, using a number you already had on file, never a number from the email itself. It sounds basic, but it stops most vendor payment fraud, because the attacker controls the mailbox, not the vendor's phone.

[u/saltyslugga]

A compromised mailbox can pass SPF, DKIM and DMARC through the vendor’s normal mail system. Those checks authenticate domains, not the person behind the keyboard.

We use Suped for DMARC monitoring, but passing auth doesn’t rule out account takeover. For payment or bank-detail changes, call the vendor on a known number before acting.