Say a colleague is about to connect an AI helper to summarise one email thread, then notices it wants permission to read their whole mailbox. That small task could give a vendor access to unrelated confidential customer emails.
I'd pause the connection, but the request itself is reasonable. What do you offer staff who want help with one thread when the tool wants the whole inbox?
Say a user gets their mailbox back after a takeover and the ticket is about to close. The attacker might still have access to accounts they took over through password reset emails.
I'd be wary of leaving the user to remember every account, but helpdesk probably doesn't have a complete list either.
Which accounts does your team check, and which checks do you leave to the user?
Say a customer's approval email is missing, search and spam turn up nothing, and work is on hold. They insist it's sent and are getting annoyed at being asked to try again.
I'd lean toward a quick call, but that interrupts both people's day. Another resend request is easy for IT to send and more homework for a customer who thinks they've already done their part.
What's your next move when “please resend it” is going nowhere?
Recurring SMTP deferrals leave client messages queued while the provider reports healthy service. Under pressure to restore delivery, we can end up changing connectors and filters without knowing which hop is holding the mail.
I lean toward freezing those changes and escalating upstream when queues repeatedly drain and fill without a config change. But traffic can change independently, and waiting on support won't fix a relay limit we're hitting ourselves.
What tenant-visible evidence has convinced you to keep that freeze in place, or break it to fix delivery locally?
A client domain shows SPF, DKIM, and DMARC in DNS, yet mail authentication results vary by receiver. That leaves us unable to tell whether spoofing protection is live or we're seeing different cached versions of a broken rollout.
Authoritative queries return the expected TXT records. Two public checkers disagree on the DMARC policy, and test messages alternate between aligned DKIM, SPF-only pass, and DMARC fail depending on destination; selectors and return paths look consistent at first pass.
My next move would normally be comparing resolver paths and raw headers, but stale delegation, duplicate records, and sender-specific routing are all plausible. Which signal do you trust first here: authoritative DNS, repeated receiver headers, or DMARC aggregate data?
A client user is receiving unsolicited order confirmations every day, and the mailbox noise is starting to hide legitimate security alerts. This could be someone mistyping or reusing the address, a compromised mailbox, or a low-volume email-bombing diversion.
Message trace shows inbound mail only, Sent Items is clean, and there are no obvious forwarding rules or unusual sign-ins. Volume sits around 20 to 40 messages daily from real retailers, with mixed customer names and no single burst.
Would you check MailItemsAccessed and OAuth grants first, or does this pattern need a higher volume or a buried password-reset alert before you contain the mailbox?
Client moved authoritative DNS at 10:00, and their invoicing ESP started getting customer complaints by noon. The receiver trace showed dkim=permerror (key syntax) for s=inv2026, d=mail.client.example; SPF passed on the ESP bounce domain, but that identity did not align with the visible From, so DMARC failed.
The old zone held one TXT RR with two quoted character-strings. The migration UI imported them as two separate TXT RRs at the same selector, and dig +short showed two lines instead of one concatenated 2048-bit key.
Statements landed in spam for about two hours. The client now wants a post-migration check, but a plain DNS diff would flag harmless TXT presentation changes while still missing whether receivers can validate a real signature.
What diagnostic signal would you use as the cutover gate here, and what failure would make you roll DNS back?
Laundry Bear exploited Zimbra CVE-2025-27915 when targets merely opened or previewed a crafted email. writeup here
Patch affected Zimbra servers now and hunt for messages carrying suspicious calendar content.
A client's payroll manager emailed a PDF containing 14 SSNs to a personal Gmail account. Outbound email DLP blocked the attachment, then 18 minutes later the same recipient got a OneDrive link to the file with no mail alert.
The sanitized mail trace ended with 250 2.6.0 Queued mail for delivery and showed no transport-rule event. The audit log recorded Operation=AnonymousLinkCreated against the same PDF four minutes before the email, with the link scope set to anonymous.
I don't buy that the control is working if email can carry a public pointer to the exact file it just blocked. Disabling anonymous links would break several contractor workflows, and inspecting every cloud URL in outbound mail will create its own mess.
What diagnostic signal or correlation would you trust next to separate clumsy sharing from deliberate mail-channel exfiltration?
> “Artificial intelligence and LLMs can be surprisingly ineffective against text salting.”
https://www.darkreading.com/threat-intelligence/1m-emails-hidden-text-dupe-ai-security-filters
Another reminder that “AI-powered” means nothing if basic content manipulation gets past it.
Stored XSS in a webmail client is about as bad as it sounds. Patch the Classic Web Client before someone turns a crafted email into session access.
https://thehackernews.com/2026/07/critical-zimbra-flaw-could-let-crafted_0483473395.html
A client user reported a fake DocuSign email that landed cleanly in the inbox. Gmail logs showed a routing rule named “Internal App Relay” had bypassed spam checks because the message matched its broad envelope filter.
The app owner left 11 months ago, the relay is undocumented, and nobody can name what still sends through it. Disabling the rule might break scanner or ticketing mail, but leaving it means an unknown path around Gmail filtering stays open.
Would you kill the bypass immediately and make each app prove its case, or give the client 48 hours to find an owner first?
A client asked us to price BIMI/VMC because marketing wants the logo showing in Gmail, while their DMARC rua still has 11 sources and two DKIM selectors nobody can name.
The pushback was predictable: they are already at p=quarantine, so apparently the rest is polish.
I'm not against BIMI, but paying for brand polish before you know who is sending as your domain is backwards. If nobody can explain each selector and rua source, the logo can wait.
Would you block the spend until the sender inventory is clean, or let marketing pay while security fixes it in parallel?
> Phishers Gain Persistence at EU, Asia Hospitality Orgs
https://www.darkreading.com/cyberattacks-data-breaches/phishers-persistence-eu-asia-hospitality-orgs
ZIP files keep working because too many places treat attachment blocking like user pain instead of a control.
Client wants DMARC at p=reject on the root domain before renewal paperwork goes in this month. Their normal mail is clean enough, but 31 copiers across 5 sites are still sending scan-to-email through the ISP SMTP relay as invoices@clientdomain.com.
SPF is either failing or passing for the ISP's envelope domain, not aligned with the client's domain. No DKIM, because of course the copier fleet has firmware from three different eras and half of it barely supports modern SMTP auth.
My answer is to stop pretending this is production mail until it can send through a real relay with aligned SPF or DKIM. The pushback is predictable: accounting likes the From address, facilities owns the copiers, and nobody wants scan workflows touched before quarter-end.
Would you hold p=reject until the copier path is fixed, or publish reject and let broken scan-to-email become the forcing function?
> Threat actors are moving beyond broad, one-size-fits-all campaigns.
https://cofense.com/blog/the-platform-you-trust-is-the-platform-they-target
This is why checking one desktop browser path and calling it covered is weak testing.
Client bought outbound email DLP, left every rule in monitor-only, then asked us to recall a sent patient roster after the external SMTP handoff had already accepted it.
Legal wanted to know why the tool “let it happen.” Compliance wanted a report. Operations wanted the email pulled back like that is a real control once it has left their tenant.
This is the part that drives me nuts. Monitor-only is fine for tuning, but after 30 days it is either a blocking rule or it is logging with nicer screenshots.
Would you let a healthcare client keep PHI rules in monitor-only after tuning, or make them sign the risk every time they refuse to block? end of rant
Are people still treating SPF, DKIM, and DMARC pass as proof a message was benign after stuff like this?
https://www.suped.com/blog/blesta-ransom-email-shows-why-spf-dkim-and-dmarc-do-not-prove-intent
Email auth tells you whether the sender was authorized, not whether the content was legit. If the account or service is abused, auth passing is exactly what I'd expect.
> M3AAWG’s 67th General Meeting Brings Clarity, Connections in High-Stakes Time for Online Safety
https://www.m3aawg.org/blog/M3AAWG67MontrealRecap
Dry read, but abuse handling still works best when operators are in the same room comparing notes.
Nonprofit client had a credential phish land in about 40 Gmail inboxes Monday, and the first report we got was three screenshots pasted into a ticket. No headers, no original message, just an ops manager asking if staff had clicked the fake file-share link.
We pulled one copy from a user mailbox, grabbed the Gmail Message-ID, and used Google Workspace Security Investigation Tool to find the rest and bulk remove it. That part was boring, fast, and exactly what I want during email IR.
The filter missed it because the sender was a compromised donor account with normal-looking history, so I'm not pretending this solves the whole attack surface. But cleaning by Message-ID without chasing 40 users for headers saved us from a messy half-day.
Only part I still wrestle with is who gets delete rights. In Workspace shops, are you giving this to helpdesk with guardrails, senior admins only, or break-glass during mail incidents?