Phishing email with anomalous Rspamd auth header signatures (DKIM/ARC/DMARC)

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•2

Detects incoming emails processed by Rspamd that exhibit suspicious authentication header signatures. The rule identifies emails lacking DKIM, ARC, or user agent information while simultaneously showing a zero receive count, potentially indicating spoofed, unauthenticated, or malformed phishing attempts.