Inbound Sender Domains Failing Email Authentication

Hunt Hypothesis

This rule identifies inbound email sender domains with high rates of DMARC, DKIM, and SPF authentication failures, indicating potential adversary use of spoofing or domain hijacking to deliver phishing payloads (T1566). Proactively hunting for these domains allows the SOC team to isolate compromised or malicious senders before they successfully compromise user credentials or deploy malware within the Azure Sentinel environment.

KQL Query

// Inbound sender domains with the most email authentication failures (DMARC, DKIM, SPF, Composite Authentication).
EmailEvents
| where Timestamp > ago(30d)
| where OrgLevelPolicy !in ("Phishing simulation", "SecOps Mailbox")
| where EmailDirection == "Inbound"
| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)
| summarize arg_max(Timestamp, *) by Key
| extend Auth = parse_json(AuthenticationDetails)
| summarize TotalInbound = count(), MessagesFailingAnyAuth = countif(tostring(Auth.DMARC) == "fail" or tostring(Auth.DKIM) == "fail" or tostring(Auth.SPF) == "fail" or tostring(Auth.CompAuth) == "fail"), DMARCFail = countif(tostring(Auth.DMARC) == "fail"), DKIMFail = countif(tostring(Auth.DKIM) == "fail"), SPFFail = countif(tostring(Auth.SPF) == "fail"), CompAuthFail = countif(tostring(Auth.CompAuth) == "fail") by SenderDomain = SenderFromDomain
| where MessagesFailingAnyAuth > 0
| top 20 by MessagesFailingAnyAuth
| project SenderDomain, MessagesFailingAnyAuth, DMARCFail, DKIMFail, SPFFail, CompAuthFail, TotalInbound

Analytic Rule Definition

id: 5722f6ce-0ac1-4783-9e15-3f7e390abe01
name: Inbound Sender Domains Failing Email Authentication
description: |
  This query lists inbound sender domains with the most email authentication failures (DMARC, DKIM, SPF, and Composite Authentication), using the EmailEvents table.
description-detailed: |
  Email authentication failures (DMARC, DKIM, SPF, and Composite Authentication) are a leading indicator of spoofing and Business Email Compromise (BEC). This query counts inbound messages that failed each authentication check, grouped by sender domain, and ranks domains by the number of messages that failed any check, with the total inbound volume for context. Persistent authentication failures from a domain that should be sending legitimate mail warrant investigation, and confirmed external spoofers are candidates for blocking.
  This query is part of the Microsoft Defender for Office 365 Detections and Insights workbook in Microsoft Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-3-build-custom-email-security-reports-with-power-bi-and-workbooks-in-micros/4490127
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  // Inbound sender domains with the most email authentication failures (DMARC, DKIM, SPF, Composite Authentication).
  EmailEvents
  | where Timestamp > ago(30d)
  | where OrgLevelPolicy !in ("Phishing simulation", "SecOps Mailbox")
  | where EmailDirection == "Inbound"
  | extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)
  | summarize arg_max(Timestamp, *) by Key
  | extend Auth = parse_json(AuthenticationDetails)
  | summarize TotalInbound = count(), MessagesFailingAnyAuth = countif(tostring(Auth.DMARC) == "fail" or tostring(Auth.DKIM) == "fail" or tostring(Auth.SPF) == "fail" or tostring(Auth.CompAuth) == "fail"), DMARCFail = countif(tostring(Auth.DMARC) == "fail"), DKIMFail = countif(tostring(Auth.DKIM) == "fail"), SPFFail = countif(tostring(Auth.SPF) == "fail"), CompAuthFail = countif(tostring(Auth.CompAuth) == "fail") by SenderDomain = SenderFromDomain
  | where MessagesFailingAnyAuth > 0
  | top 20 by MessagesFailingAnyAuth
  | project SenderDomain, MessagesFailingAnyAuth, DMARCFail, DKIMFail, SPFFail, CompAuthFail, TotalInbound
version: 1.0.0

Required Data Sources

MITRE ATT&CK Context

• Tactic: InitialAccess
• Technique: T1566 — T1566

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Authentication/Inbound Sender Domains Failing Email Authentication.yaml)

False Positive Guidance

• Marketing Automation and Newsletter Campaigns: High-volume inbound emails from marketing platforms like Mailchimp, HubSpot, or SendGrid often fail composite authentication checks if the sending IP rotates or if the DKIM key is misconfigured for specific subdomains.
  • Filter/Exclusion: Exclude known marketing vendor domains (e.g., *.sendgrid.net, *.mailchimp.com) or filter for MessageDirection -eq "Inbound" where SenderDomain matches a curated list of trusted marketing SaaS providers.
• Internal Ticketing and Monitoring Systems: Automated alerts from tools like ServiceNow, Jira, Datadog, or PagerDuty may use shared relay servers or dynamic IPs that do not consistently align with SPF records, leading to frequent SPF or DKIM failures.
  • Filter/Exclusion: Create an exclusion list for specific internal application domains (e.g., alerts.datadoghq.com, jira.yourcompany.com) or filter based on Subject containing known automation keywords (e.g., “Alert”, “Ticket”, “Report”) combined with specific sender domains.
• Legacy Application Integrations: Older internal applications or scheduled jobs (e.g., nightly database backups, financial reporting scripts) that send emails via a shared SMTP relay without proper DKIM signing or SPF inclusion for the relay IP.
  • Filter/Exclusion: Identify and exclude domains associated with legacy systems (e.g., legacy-app.yourcompany.com) or filter for senders where AuthenticationResult shows SPF: Pass but DKIM: Fail if the system is known to rely solely on SPF.
• Third-Party HR and Payroll Vendors: Inbound communications from HR platforms like Workday, ADP, or Paylocity may use rotating IP ranges or subdomains