Should I take action if I receive a phishing email that passes all email sender checks?

Question

I received an email that passed all the email sender checks (spf, dkim, dmarc), and the sent-from domain is a legitimate domain from a legitimate company. However, the email content itself was suspiciously phish-y. I even started to write a reply email advising they were mistaken, until I noticed that the reply-to was actually to another email domain. The reply-to domain goes nowhere and it's just a registered name with no hosted website, making me conclude this was indeed a phishing email.

Seeing that the legitimate companies' email security was compromised somehow, should I inform them? If so, how? Any information to give to the legitimate company about the phishing email?

Answer 1

SPF, DKIM, and DMARC just tell you if the sender spoofed the domain or if a legitimate email was hijacked. They are not "security checks". I can set up a malicious domain, set legitimate SPF, DKIM, and DMARC DNS records, and pump out malware-ridden emails all day long which will pass sender checks.

Or, I could compromise the account of a legitimate company and pump out phishing emails with malware in attachments and bad links, and those emails, too, would pass all the sender checks.

So, yes, even if sender checks pass, you still need to stay aware of security matters.

Whether or not to inform the company is a matter of being a good Internet-citizen and if there is a method to report something like this. If the account was compromised, sending an email back to the same account might not work since the attacker might be monitoring emails. It would be better to report to a reporting email or to a security department.

Answer 2

From what you describe it is plausible a security incident occurred at the company that sent the e-mail. That is, of course, if you are certain the domain used is an exact match (not typosquatted) to the company domain AND the e-mail is not just a very bad legitimate e-mail.

You are not required to do anything, although most companies would appreciate it if they would be informed of something like this. Check if they have a dedicated process for security incident reports. Otherwise, you could try to forward the e-mail to their abuse@ mailbox, stating that you received phishing originating from their systems.

It is not necessarily a compromise of their entire e-mail security, it is possible a single employee was targeted and e-mails were sent on their behalf. But that is not determinable based on the limited information in the question.