Domain Spoofing - Envelope vs. Header Mismatch

Ibrahim Saud@tektrix

•updated Jun 21, 2026•2•0•15

Detects malicious emails bypassing spam filters due to a mismatch between the P1 (Envelope) and P2 (Header) sender addresses, exploiting routing misconfigurations. Specifically, it looks for emails where the 'SenderFromDomain' (P2 header) matches 'yourcompany.com' but differs from 'SenderMailFromDomain' (P1 envelope), and the email was successfully delivered.