Business email compromise and targeted phishing usually pass authentication checks: what gives them away is that the sender has no real history with the person receiving the message. MITRE D3FEND names this countermeasure Sender Reputation Analysis (D3-SRA) and defines it as "Ascertaining sender reputation based on information associated with a message (e.g. email/instant messaging)." It sits in the Detect tactic as a child of Message Analysis (D3-MA), alongside D3-SMRA Sender MTA Reputation Analysis, and analyses the Email artefact. This card covers the sender features D3FEND describes, the ATT&CK techniques it relates them to, how the idea appears in mail platforms, how to test it and where it breaks. It is written for email security engineers, SOC analysts and fraud teams; the BEC background is in the Email Identity and BEC Guide.
Key takeaways
- D3-SRA scores the sender address against your organisation's own history. First contact, reply patterns and how many of your people talk to that sender matter more than any public reputation list.
- It complements authentication. SPF, DKIM and DMARC prove a domain sent the message; sender reputation asks whether this sender is someone you actually deal with.
- A compromised trusted account defeats it. Mail from a real supplier or colleague mailbox inherits years of good history, so behaviour and content signals must still run.
- The ATT&CK mapping is inferred through the Email artefact. Relevance to phishing techniques is real; relevance to local email collection is only nominal.
- Prove it with first-contact tests. Send from a new external address and confirm the warning, score or action appears for the right recipients.
D3-SRA at a glance
| Field | D3-SRA Sender Reputation Analysis |
|---|---|
| D3FEND ID | D3-SRA |
| Tactic | Detect |
| Parent technique | Message Analysis, D3-MA (sibling: Sender MTA Reputation Analysis, D3-SMRA) |
| Digital artefact | Email (D3FEND: the technique "analyzes" Email); D3FEND's definition also names instant messaging |
| What it scores | The sender identity (address and display name) based on its interaction history with the organisation |
| Verdict bands in D3FEND | Unrated, neutral, trusted, suspicious, malicious |
| Typical implementation points | Mail platform anti-phishing and impersonation features, email security services with communication graph analysis, SIEM analytics on message trace and mailbox audit data |
| Main limitation | Compromised trusted senders and look-alike addresses that are new but plausible |
| D3FEND reference | Graphus Inc patent US20170324767A1 (sender profiles, recipient interaction profiles, message trust rating) |
How it works
D3FEND describes a sender trust rating as an indicator of the risk or trust level associated with a sender, built from interaction features. The patent it cites pairs a sender profile with a recipient interaction profile and alerts when the resulting message trust rating signals risk. The features D3FEND lists group naturally into four families:
| Feature family | D3FEND features | What it catches |
|---|---|---|
| Tenure and volume | Length of time the sender has emailed the enterprise; number of emails received from the sender | First-contact senders, including look-alike domains registered for one campaign |
| Breadth | Number of enterprise recipients the sender interacts with | A "supplier" who writes only to the finance team member who pays invoices |
| Two-way relationship | Sender vs enterprise originated message ratio; emails sent to the sender; emails replied to the sender; replies received from the sender | One-way senders posing as established contacts |
| Engagement | Opened vs not-opened ratio; emails not opened; not opened with an attachment; not opened with a URL | Senders your users habitually ignore, whose mail is likely unsolicited |
Higher interaction pushes the rating up. As with D3-SMRA, D3FEND notes that a legitimate sender's rating may fall over time if its domain is spoofed and used for unauthorised mail. The useful design choice is per-recipient scoring: a sender can be trusted by procurement and unknown to the chief financial officer, and the second case is the one that matters for invoice fraud.
The sender reputation verdict is one input. It should be combined with authentication results (see the D3-MAN Message Authentication card), the reputation of the sending server (D3-SMRA) and the reputation of the domain itself (D3-DNRA Domain Name Reputation Analysis).
ATT&CK techniques and D3-SRA
Relationship type: inferred only. D3FEND derives these rows because D3-SRA analyses Email and each technique produces or acts on Email; the D3FEND page calls the mappings "inferred, experimental" (checked November 2026). The page showed the first four rows; T1667 Email Bombing is linked to Email in the D3FEND ontology release. The last column is NHI Mgmt Group's assessment.
| ATT&CK ID | Technique (tactic) | What sender reputation adds (NHI Mgmt Group assessment) |
|---|---|---|
| T1566.001 | Spearphishing Attachment (Initial Access) | Strong signal when the sender is new to the recipient; weak when a known supplier account is compromised |
| T1566.002 | Spearphishing Link (Initial Access) | Same pattern; combine with D3-URA URL Reputation Analysis |
| T1534 | Internal Spearphishing (Lateral Movement) | Limited: internal senders have strong history; a change in a known sender's behaviour (new recipients, unusual volume) is the better signal |
| T1114.001 | Local Email Collection (Collection) | Nominal: shared artefact only; collection is detected on the endpoint |
| T1667 | Email Bombing (Impact) | Useful for triage: a flood of first-contact senders to one mailbox is distinctive, and often precedes help desk impersonation |
See the T1534 Internal Spearphishing guide and the Email Bombing and Help Desk Impersonation over Teams Guide for the attacker side.
Where it is implemented
Most organisations meet D3-SRA as a platform feature rather than something they build. Two widely used mail platforms describe it as follows (platforms are listed alphabetically; examples, not recommendations).
- Google Workspace: the Gmail advanced phishing and malware protection settings include a "Spoofing and authentication" group that covers domain spoofing based on similar domain names, employee name spoofing, inbound mail spoofing your domain and unauthenticated email, which Gmail marks with a question mark next to the sender's name. Admins choose an action per protection: Warning, Move email to spam or Quarantine.
- Microsoft Defender for Office 365 and Exchange Online Protection: anti-phishing policies include "Show first contact safety tip", which displays "You don't often get email from" a sender when a recipient first or rarely hears from them, and mailbox intelligence, which learns users' patterns with frequent contacts. Mailbox intelligence is on by default; "Enable intelligence for impersonation protection" is off by default and both must be on before actions apply.
Availability: Google lists these settings under Gmail advanced safety; Microsoft states that first contact safety tip is available to all cloud mailboxes and mailbox intelligence to Defender for Office 365. Check your edition in each vendor's documentation.
- Email security services with communication graph analysis: build a per-recipient sender history across the tenant and score deviations, the closest product match to the D3FEND feature list. See the Email Security Buyer's Guide.
- SIEM analytics: first-seen sender per recipient, sender to recipient breadth and reply ratio, from message trace. See the Email Gateway and Message Trace Detection Guide.
Implementation steps
- Turn on the platform's first-contact and impersonation features in warn mode. Use banners or safety tips before quarantine, so users and the SOC see verdicts without lost mail.
- Define protected people and partners. Executives, finance approvers, payroll and the top suppliers by payment value are where sender history matters most.
- Build first-seen analytics. For each (sender, recipient) pair record first message date, count and replies; alert when a first-contact sender writes to a protected person with payment, credential or urgency language.
- Add behaviour-change rules for known senders. A trusted supplier writing to new recipients, changing bank details or using a new reply-to address is the compromised-account case reputation alone misses.
- Raise actions gradually. Move from warning to quarantine for the highest-risk combinations (first contact plus look-alike domain plus payment request) after reviewing false positives.
- Roll back by policy. Keep a tested path to return to warn-only, and keep quarantined mail available for release.
Small and large organisations
| Size | Practical scope |
|---|---|
| Small (under a few hundred mailboxes) | Platform first-contact tips and spoofing protections, plus a manual list of payment-related suppliers; out-of-band call-back for any bank detail change |
| Large or regulated | Per-recipient sender history in the SIEM or a graph-based email security service, protected-user lists maintained by HR and finance, and alert routing to a fraud response playbook |
How to verify it works
- First-contact test: send from a fresh external mailbox to a test recipient and confirm the warning or score appears, then reply a few times and confirm it stops as history builds.
- Look-alike test: send from an authorised test domain resembling a partner's and confirm the impersonation verdict.
- Multi-recipient behaviour: where a platform shows a tip to some recipients and not others, confirm the result matches your expectation; Microsoft describes a majority model for multi-recipient messages.
- Exception review: list allowed senders and domains that bypass these checks and confirm each has an owner.
| Metric | What it shows |
|---|---|
| Share of confirmed phishing or BEC where the sender was first contact to the recipient | How much of the threat this control can see |
| Share of those that were warned, quarantined or alerted at delivery | Detection coverage |
| User reports per 1,000 first-contact warnings | Whether users act on warnings or ignore them |
| False positive releases from impersonation quarantine | Threshold tuning |
| Sender allow entries without owner or review date | Exception drift |
Limits, bypasses and failure patterns
- Compromised trusted senders: mail from a real supplier mailbox carries full history. Detection must rely on behaviour change and out-of-band payment verification. See the Business Email Compromise Response Playbook.
- Warning fatigue: first-contact banners on every newsletter teach users to ignore them. Tune scope to protected people and risky content.
- Broad sender allow lists: allowing a whole domain to fix one delivery problem lets look-alike or compromised addresses under it skip scoring.
- Thin history: new staff mailboxes and newly acquired companies have no baseline; Microsoft, for example, does not stamp the first contact tip on mailboxes created less than seven days ago.
- Channel gaps: D3FEND's definition includes instant messaging, but many organisations score email only while attackers move to chat and collaboration invites.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev. 5 | SI-8 Spam Protection; SI-4 System Monitoring | Inbound message protection and monitoring for anomalous senders |
| NIST CSF 2.0 | DE.CM-01; DE.AE-02 | Monitoring and analysing potentially adverse events |
| CIS Controls v8.1 | Control 9 Email and Web Browser Protections | See the CIS Control 9 Email and Web Browser Protections Guide |
| ATT&CK mitigations | M1017 User Training; M1054 Software Configuration | Warnings only work if users are trained to act on them; see M1017 User Training |
Practitioner checklist
- Enable first-contact and spoofing or impersonation protections in warn mode first.
- Maintain a protected-people list and a payment-supplier list with owners.
- Score senders per recipient, not only per organisation.
- Alert on first-contact senders to protected people with payment or credential themes.
- Add behaviour-change rules for known senders (new recipients, new reply-to, bank detail changes).
- Run a monthly first-contact and look-alike test and record the result.
- Review sender and domain allow entries quarterly.
- Extend sender scoring to chat and collaboration channels where the platform allows.
Standards and references
- MITRE D3FEND: Sender Reputation Analysis (D3-SRA)
- MITRE D3FEND: Message Analysis (D3-MA)
- Graphus Inc: Systems and methods for detecting and/or handling targeted attacks in the email channel (US20170324767A1)
- MITRE ATT&CK: T1566 Phishing
- MITRE ATT&CK: T1534 Internal Spearphishing
- Google Workspace: Advanced phishing and malware protection
- Microsoft Learn: Anti-phishing policies
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls
Related NHI Mgmt Group resources: Email Identity and BEC Guide · D3-SMRA Sender MTA Reputation Analysis · Business Email Compromise Awareness for Finance Teams Guide · Email Security Guide · MITRE D3FEND Guide