Authentication-passing phishing: what are teams missing in email security?

TL;DR: Phishing emails can clear SPF, DKIM and DMARC, and still be hostile because authentication verifies the wire, not the sender’s intent, display name, Reply-To path, or body semantics, according to IRONSCALES research. The control gap is now behavioral detection around sender novelty, routing consistency, and downstream content changes, not stricter envelope checks alone.

Editorial analysis by NHI Mgmt Group, based on content published by IRONSCALES: “Best of the Worst: Five Attacks That Cleared Authentication and Landed Anyway”.

Key questions

Q: How should security teams handle authenticated phishing that passes SPF, DKIM, and DMARC?

A: Security teams should treat authenticated delivery as a starting signal, not proof of legitimacy.

Q: Why do authenticated emails still create phishing risk?

A: Because authentication proves who sent the message, not whether the message is trustworthy to the recipient.

Q: What are the signs that an email looks legitimate but is still risky?

A: Look for a new domain or tenant, a sender name that imitates a real employee, a Reply-To mismatch, a conversation that feels artificially continued, and a message that asks for action through a phone number or a single external document.

Practitioner guidance

• Tighten sender trust scoring Weight first-time senders, newly registered domains, and unusual tenant geography more heavily than header alignment alone when deciding whether a message deserves user trust.
• Re-verify message integrity at the last hop Ensure the security gateway checks the delivered body after all relays, banners, and transformations, not only the original signed content.
• Add Reply-To and display-name correlation Compare Reply-To domains with the visible sender and the known vendor relationship, and flag mismatches or internal-name impersonation as separate signals.

Bottom line: Passing SPF, DKIM and DMARC does not prove that an email is trustworthy, only that the message travelled through an authenticated path.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →