Good Morning All, I've been thrown into the deep end with a request from my director. I know little of DMARC and email spoofing in general, but I'm trying to somehow weed out WHY this spoof email "passed". It's coming from some "aw[email protected]" with the display name of one of our VPs. :(
I'm also concerned because the aggregate report did not include this email... I searched through Jan 31, Feb 1, and 2. Where did it go?
See below... I'm actually not 100% what is "Safe" to share from the email header, but the info below seemed safe enough to post (I x'd out the employees name and our domain). Please let me know if I revealed anything I shouldn't have (locking stable after horse has bolted, I know).
Any help would be appreciated!
Delivered-To: [email protected]
Received: by 10.200.57.59 with SMTP id s56csp1949294qtb; Tue, 31 Jan 2017 06:53:50 -0800 (PST)
X-Received: by 10.55.72.210 with SMTP id v201mr26460280qka.145.1485874430676; Tue, 31 Jan 2017 06:53:50 -0800 (PST)
Return-Path:
Received: from mail-qt0-x242.google.com (mail-qt0-x242.google.com. [2607:f8b0:400d:c0d::242]) by mx.google.com with ESMTPS id g56si12092937qte.273.2017.01.31.06.53.50
for
(version=TLS1_2 cipher=XXXXX-XXX-XXXXX-XXX-XXXXX bits=128/128); Tue, 31 Jan 2017 06:53:50 -0800 (PST) Received-SPF: pass (google.com: domain of [email protected] designates 2607:f8b0:400d:c0d::242 as permitted sender) client-ip=2607:f8b0:400d:c0d::242; Authentication-Results: mx.google.com;
dkim=pass [email protected];
spf=pass (google.com: domain of [email protected] designates 2607:f8b0:400d:c0d::242 as permitted sender) [email protected];
dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=gmail.com Received: by mail-qt0-x242.google.com with SMTP id s58so19260189qtc.2 for ; Tue, 31 Jan 2017 06:53:50 -0800 (PST)