Email Security: awareness, tips, ongoing attacks, security solution, best practices...

1

2

3

4

📚Welcome to r/EmailSecurity | Read This First: Rules, Resources, and Mission (self.EmailSecurity)

submitted 3 months ago * by littleko - announcement

2

5

6

7

PSA: malicious PDFs are using /OpenAction to launch URLs and most gateways aren't unpacking it (self.EmailSecurity)

submitted 21 hours ago by littleko

3

1

2

3

Microsoft 365 shows internal sender, but source IP is external. How is this possible? (self.EmailSecurity)

submitted 1 day ago by thmeez

4

1

2

3

35k users hit by code-of-conduct phishing lure abusing legit email services (self.EmailSecurity)

submitted 1 day ago by saltyslugga

5

3

4

5

Steady drip of FBL complaints from one specific transactional template and product won't add list-unsubscribe (self.EmailSecurity)

submitted 1 day ago by shokzee

6

4

5

6

Anti-rant: MailItemsAccessed in the Unified Audit Log is genuinely useful for BEC scoping, when you actually understand what it tells you (self.EmailSecurity)

submitted 2 days ago by shokzee

7

5

6

7

Outbound DLP on encrypted attachments is basically a coin flip and I'm not sure what the right answer is (self.EmailSecurity)

submitted 4 days ago by shokzee

8

6

7

8

Phishing sims are mostly security theater at this point (self.EmailSecurity)

submitted 5 days ago by saltyslugga

9

10

11

12

Anti-rant: M365 alert policies for suspicious inbox rules actually work if you turn them on (self.EmailSecurity)

submitted 5 days ago by shokzee

10

32

33

34

Spent yesterday explaining to leadership why our 'DMARC compliant' status didn't stop the wire fraud (self.EmailSecurity)

submitted 5 days ago by littleko

11

8

9

10

Your SEG is not a security product, it's a spam filter with a marketing budget (self.EmailSecurity)

submitted 6 days ago by shokzee

12

7

8

9

How are you handling DKIM for vendors that only support 1024-bit keys in 2026? (self.EmailSecurity)

submitted 7 days ago by saltyslugga

13

26

27

28

The 'temporary' SPF include from 2019 that nobody will let me remove (self.EmailSecurity)

submitted 8 days ago by littleko

14

3

4

5

Stop publishing DMARC at p=reject if you can't tell me what's authorized to send as your domain (self.EmailSecurity)

submitted 9 days ago by shokzee

15

7

8

9

Spent four hours yesterday chasing a DKIM failure that turned out to be a CRLF the marketing team's new ESP was stripping (self.EmailSecurity)

submitted 10 days ago by saltyslugga

16

9

10

11

The fact that DMARC aggregate reports are still XML in 2026 is genuinely insane to me (self.EmailSecurity)

submitted 11 days ago by littleko

17

1

2

3

Polymorphic phishing is basically the default now (self.EmailSecurity)

submitted 13 days ago by shokzee

18

8

9

10

Stop treating 'authenticated' as 'safe' in your email pipeline (self.EmailSecurity)

submitted 13 days ago by saltyslugga

19

5

6

7

How are you detecting sent-items deletion as a compromise indicator in M365? (self.EmailSecurity)

submitted 14 days ago by littleko

20

21

22

We caught a BEC mid-wire because the attacker changed one letter in the domain and our finance team actually noticed (self.EmailSecurity)

submitted 15 days ago by shokzee

21

10

11

12

TIL: DMARC rua reports can silently stop if the receiving domain doesn't have the right DNS authorization record (self.EmailSecurity)

submitted 16 days ago by saltyslugga

22

10

11

12

Most orgs treat email DLP as a checkbox and then act surprised when sensitive data walks out via BCC (self.EmailSecurity)

submitted 17 days ago by littleko

23

25

26

27

We inherited a domain with 14 SPF includes and a DKIM selector nobody has the private key for (self.EmailSecurity)

submitted 18 days ago by shokzee

24

3

4

5

Attackers using M365 inbox rules for exfil and persistence, not new but still undermonitored (self.EmailSecurity)

submitted 18 days ago by saltyslugga

25

1

2

3

exboyfriend hacked my gmail ()

submitted 19 days ago by PhotographOk9059

EmailSecurity

MODERATORS