Domain Spoofing - Dangling DNS / Permissive SPF Abuse (T1566.002)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•1•0•3

Identifies emails where SenderFromDomain matches an internal legitimate domain, but the SenderIPv4 originates from an unassociated external network exploiting permissive SPF records or dangling DNS. This rule specifically looks for emails with a sender domain matching 'yourcompany.com' (which should be replaced with the actual tenant domain), where the sender's IPv4 address is not from internal networks (excluding 10.0.0.0/8 and 192.168.0.0/16), and the SPF authentication passed. It further ensures that the originating IP address is not known to internal devices via network connection events, helping to filter out legitimate internal mail relays or services.