I am trying to figure out how we were spoofed for education purposes. The email came in perfectly with the user's email address and name. The only way we found out was the header information. Most spoofing I see, I can tell by looking at the from address and it will be different but with the person's name. This one was different. In Outlook, it truly looked as if the email was sent from themselves. As you may have guessed they were trying to convince the user that his email was hacked. I have attached an image with the header info. Any help is understanding this would be greatly appreciated as I work on trying to find a way to detect and block.
Authentication-Results spf=none (sender IP is 000.000.000.000)
smtp.mailfrom=uuviummd.com; XXXXXXXXXXXXXXXXX.mail.onmicrosoft.com; dkim=none
(message not signed) header.d=none;XXXXXXXXXXXXXXXXX.mail.onmicrosoft.com;
dmarc=none action=none header.from=XXXXX.com;
Authentication-Results field of the mail header clearly says that there is neither and SPF policy (
spf=none) nor a DMARC policy (
dmarc=none) for your domain nor does it contain DKIM records (
dkim=none). This makes the domain easy to spoof.
For more on this see Why is it even possible to forge sender header in e-mail?.