Mail filters make thousands of verdicts a day, but few teams can say which signals drove a verdict, how a trusted sender's compromised mailbox would score, or how to test the analysis at all. MITRE D3FEND groups this work under Message Analysis (D3-MA), defined as analysing email or instant message content to detect unauthorised activity, in the Detect tactic. In the D3FEND ontology the family has two children, both about reputation: Sender MTA Reputation Analysis (D3-SMRA) and Sender Reputation Analysis (D3-SRA). This guide covers what the family is for, how the two children combine with neighbouring D3FEND techniques, how to deploy and tune message analysis, how to verify and measure it, and where it falls short. It is written for email security engineers and detection teams; each child has its own page on this site. For D3FEND itself see the MITRE D3FEND Guide, and for the wider email stack see the Email Security Guide.
Key takeaways
- Message Analysis is a Detect family about trust. D3FEND's own article notes that attackers avoid suspicion when the recipient trusts the sender, and that analysis ranges from deep content analysis and execution to social graph analytics of trust or risk.
- Its two children score where mail comes from. D3-SMRA characterises the sending mail transfer agent; D3-SRA characterises the sender from information associated with the message.
- Content, links and attachments sit in other D3FEND families. URL analysis, file analysis and message authentication are separate techniques, so a complete deployment combines several families.
- Reputation fails against trusted senders. Compromised supplier mailboxes and internal accounts carry good reputations, so pair D3-MA with behaviour and content checks.
- D3FEND's ATT&CK links are inferred. The site relates D3-MA to Local Email Collection, Spearphishing Attachment, Spearphishing Link and Internal Spearphishing through the Email artefact, and labels them inferred and experimental.
What D3FEND means by Message Analysis
The D3FEND ontology gives D3-MA the synonyms Email Or Messaging Analysis and Electronic Message Analysis, and its knowledge base article makes two points. First, email and messaging are routine delivery channels for exploits and social engineering, and trust in the sender is what makes them work. Second, messages are complex data structures with files, links and regional encodings, so the analytic methods are highly varied. The parent carries no artefact relation itself; both children "analyze" the Email artefact.
The definition names instant messaging as well as email, but both current children are framed around email. Collaboration platforms (chat, channels, external federation) need the same thinking, applied through each platform's own controls.
The child techniques
| D3FEND technique | D3FEND definition (summary) | Signals it uses in practice | Typical enforcement point |
|---|---|---|---|
| D3-SMRA Sender MTA Reputation Analysis | Characterising the reputation of mail transfer agents to determine the security risk in emails | Connecting IP and its history, reverse DNS, TLS use, blocklist listings, volume patterns | Gateway connection filtering at SMTP time |
| D3-SRA Sender Reputation Analysis | Ascertaining sender reputation from information associated with a message | Sender domain age and history, authentication results, first contact, prior correspondence, display name and look-alike patterns | Gateway or cloud mail filtering after acceptance, mailbox-level impersonation checks |
How the family combines with neighbouring techniques
A message verdict draws on more than D3-MA. The table shows the D3FEND techniques usually run alongside it; their relationships are from the D3FEND ontology, and the grouping is ours.
| Question about the message | D3FEND technique | Family |
|---|---|---|
| Did the sending MTA behave like a legitimate mail server? | D3-SMRA | Message Analysis |
| Is this sender known, established and consistent? | D3-SRA | Message Analysis |
| Is the message authenticated for the domain it claims? | D3-MAN Message Authentication, D3-TAAN Transfer Agent Authentication | Message Hardening |
| Is the sending IP or domain known bad elsewhere? | D3-IPRA IP Reputation Analysis, D3-DNRA Domain Name Reputation Analysis | Identifier Analysis |
| Are the links or attachments malicious? | D3-UA URL Analysis, D3-URA URL Reputation Analysis, file analysis techniques | Identifier Analysis, File Analysis |
| How do we pull it back after delivery? | D3-ER Email Removal | File Eviction (Evict tactic) |
How to choose: D3-SMRA is cheapest and acts first, so it removes bulk and botnet mail before content scanning. D3-SRA is where targeted phishing and business email compromise are caught, because those messages often come from clean infrastructure. Authentication results (SPF, DKIM and DMARC, described in NIST SP 800-177 Rev. 1) are an input to D3-SRA rather than a replacement for it: a look-alike domain can authenticate perfectly. See the DMARC, SPF and DKIM Guide.
Implementation roadmap
- Inventory where analysis happens. Record each point that scores mail (gateway, cloud mail service filtering, mailbox-level protections, collaboration platform controls), which D3-MA child it delivers, and whether its verdicts and reasons reach your SIEM. The Email Gateway and Message Trace Detection Guide covers the telemetry.
- Fix your own sending reputation inputs. Publish SPF, DKIM and an enforcing DMARC policy for every sending domain, so other organisations' D3-SRA can trust you and spoofing of your domain fails. See the email sending sources inventory template.
- Turn on first-contact and impersonation signals. Flag first-time senders, display names matching executives, and domains resembling yours or key suppliers, at first as banners or tags rather than blocks.
- Run new rules in report mode. Log what would have been quarantined for two business cycles, review false positives with mail owners, then enforce in rings: a pilot group, finance and executives, then all users.
- Connect user reports to analysis. Route reported messages into the same pipeline, so analysts can confirm verdicts and feed sender blocks back.
- Test. Use authorised phishing simulations and benign test messages from new domains and from a lookalike domain you own to confirm the expected verdict and the log line.
Rollback: keep allow-list and policy changes in version control, and retain quarantined mail long enough to release legitimate messages; restoring wrongly removed mail is covered by D3-RE Restore Email.
Small and large organisations
- Small organisations: rely on the built-in filtering of the cloud mail service, enable its impersonation and first-contact options, and publish DMARC. Most D3-SMRA and D3-SRA value comes from those settings.
- Large or high-risk organisations: add custom sender rules for key suppliers, a lookalike domain watch list, analysis of internal mail (for compromised accounts) and correlation with identity sign-in risk.
ATT&CK behaviours D3FEND relates to Message Analysis
The D3FEND site lists these relationships as inferred and experimental, derived from the "analyzes Email" relation. IDs are ATT&CK v20.
| ATT&CK technique | Most relevant child | What analysis can show |
|---|---|---|
| T1566.001 Spearphishing Attachment | D3-SRA, D3-SMRA | New or poorly reputed sender combined with an attachment |
| T1566.002 Spearphishing Link | D3-SRA | First-contact sender, look-alike domain, mismatch between display name and address |
| T1534 Internal Spearphishing | D3-SRA | A trusted internal sender behaving unlike its history; reputation alone will not catch it |
| T1114.001 Local Email Collection | D3-SRA | D3FEND relates it through the Email artefact; detection value here is limited, as collection happens on the endpoint |
The two child pages also discuss T1667 Email Bombing, which reputation and volume signals can surface. See MITRE ATT&CK T1566 Phishing and MITRE ATT&CK T1534 Internal Spearphishing.
Limits and bypasses
- Compromised trusted senders. Mail from a real supplier mailbox has years of good reputation. Detect it through content and request patterns (bank detail changes, urgent payments) instead. See the Business Email Compromise Response Playbook.
- Reputable infrastructure. Attackers send through large cloud mail services and file-sharing notifications, whose MTAs score well under D3-SMRA.
- Aged domains. Domain age signals are bypassed by buying or waiting out older domains.
- Channels outside the gateway. Chat, collaboration platforms and personal mail are not seen by email analysis.
- Allow-list drift. Broad allow entries for marketing platforms or partners bypass every check.
Detection and measurement
Log each verdict with its reason, the sender, connecting IP, authentication results and delivery action. Useful detections include a first-contact sender that reaches many finance staff, internal accounts suddenly sending to many external recipients, and user-reported messages that the gateway delivered as clean. Metrics we suggest (example targets, not standards):
- Miss rate: percentage of confirmed malicious messages that were delivered, from user reports and retro-hunts.
- False positive rate: legitimate messages quarantined, per thousand delivered.
- Time to remove: median time from first delivery of a malicious campaign to removal from all mailboxes.
- Report-to-verdict time: how fast reported messages are triaged.
- Allow-list hygiene: number of allow entries without an owner or review date.
- DMARC enforcement: percentage of your sending domains at quarantine or reject.
Where identity fits
Many malicious messages come from accounts, not spoofed addresses: a phished user, a compromised supplier, or an application identity with send rights. Applications and scripts that send mail through API permissions or SMTP credentials are non-human identities with sender reputation of their own; inventory them, scope their send rights and watch for changes in their volume or recipients. Correlating a sender's sign-in risk with message analysis catches account takeover that reputation misses.
Framework mapping
| Framework | Reference | Link to D3-MA |
|---|---|---|
| NIST SP 800-53 Rev. 5 | SI-8 Spam Protection, SI-3 Malicious Code Protection, SI-4 System Monitoring | Mail filtering and monitoring controls |
| NIST CSF 2.0 | DE.CM-01, DE.AE-02 | Network services monitored; adverse events analysed |
| NIST SP 800-177 Rev. 1 | Trustworthy Email: SPF, DKIM, DMARC, TLS, S/MIME, DANE | Authentication inputs to sender analysis |
| CIS Controls v8.1 | Control 9 Email and Web Browser Protections | Email filtering and authentication safeguards |
| MITRE D3FEND | D3-MAN, D3-UA, D3-ER | Neighbouring techniques that complete the message pipeline |
Common failure patterns
- Treating DMARC pass as safe. A look-alike domain with perfect authentication still passes.
- No feedback loop. User reports go to a mailbox nobody triages, so misses never become rules.
- Verdicts without reasons in the SIEM. Analysts cannot tell why a message was delivered.
- Ignoring internal mail. Internal spearphishing from a compromised account skips gateway analysis entirely.
- Blocking on day one. Enforcing new impersonation rules without report mode quarantines executives' real mail and the rules get switched off.
Practitioner checklist
- Map each mail and messaging analysis point to D3-SMRA, D3-SRA or a neighbouring technique.
- Send verdicts, reasons and authentication results to the SIEM.
- Publish SPF, DKIM and enforcing DMARC for every sending domain.
- Enable first-contact, impersonation and look-alike domain signals, in report mode first.
- Analyse internal and supplier mail, not only inbound mail from strangers.
- Connect user reporting to triage and to sender blocks.
- Review allow-lists quarterly with named owners.
- Inventory applications and service identities with send rights.
Standards and references
- MITRE D3FEND: Message Analysis
- MITRE D3FEND: Sender MTA Reputation Analysis
- MITRE D3FEND: Sender Reputation Analysis
- NIST: SP 800-177 Rev. 1 Trustworthy Email
- NIST: SP 800-53 Rev. 5
- NIST: Cybersecurity Framework 2.0
- CISA, NSA, FBI and MS-ISAC: Phishing Guidance: Stopping the Attack Cycle at Phase One
- MITRE ATT&CK: Phishing
Related NHI Mgmt Group resources: MITRE D3FEND Guide · Email Security Guide · DMARC, SPF and DKIM Guide · Phishing Incident Response Playbook · Email Gateway and Message Trace Detection Guide