DMARC Spoof Detection, Failed Authentications

This report is a signal-oriented view into unauthenticated mail sources. It shows what failed and where (with limited metadata from the events); determining why requires operational context. Elements of the dataset and some of my machine-learning models will eventually make their way to GitHub.

The data here comes from DMARC analysis for domains I administer, drawn from a larger dataset comprising millions of authentication records and messages. These entries represent email attempts that failed both SPF and DKIM (often with additional alignment issues not shown here). In many cases, these failures indicate unauthorized use of the domain name and are commonly associated with spam, domain spoofing, phishing, or related abusive mail activity from these IP addresses.

There are, however, known exceptions. Some legitimate email security, spam detection, or phishing analysis services disrupt authentication as a byproduct of the processes required for message inspection, forwarding, or re-origination. I tend to track networks and IP addresses where legitimate activity disrupts email delivery or DMARC reporting. These are documented in the notes, and known disruptive services (confounders) are hidden by default. Much of this traffic is not hostile... but some is.

(More)