LegionLoader DKIM-Pass DMARC-Fail via gappssmtp.com Subdomain Misalignment

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•2

This rule monitors incoming email events for a specific domain or sender address, detecting instances where emails pass DKIM validation but fail DMARC and SPF checks while simultaneously being flagged as spam by the email security solution. This pattern is indicative of potential spoofing or unauthorized email activity.