SCARP
CS-1029
Illustrative — not customer data
Report date: 8 August 2026
Prepared for: illustrative B2B SaaS attack surface
Change-set review
CS-1029: Email spoofing
2 paths · 7 evidence entries · Owner IT operations
Decision
Publish aligned SPF, DKIM, and DMARC reject
Tells receivers to reject unauthenticated mail from the domain and every subdomain. Lookalike domains are out of scope: they are not your domain, so no DMARC policy of yours covers them.
- Owner
- IT operations
- Effort / disruption
- Half a day · Medium
- Projection confidence
- 96%
Projected
2
paths expected removed
Realized
2
paths confirmed removed
Remaining
0
paths still reachable after re-check
Change-set comparison
The selected change is shown beside the alternative that was considered. Only the selected change shipped, so only it has a re-check result.
Illustrative alternatives
Selected change
Publish aligned SPF, DKIM, and DMARC reject
- Owner
- IT operations
- Effort
- Half a day
- Disruption
- Medium
- Expected paths removed
- 2
- Realized paths removed
- 2
Considered, not shipped
Keep DMARC at p=none and monitor reports
- Owner
- Security operations
- Effort
- Ongoing
- Disruption
- Low
- Expected paths removed
- 0
- Realized paths removed
- Not re-checked
Audit closure line · 8 August 2026
Change set CS-1029, owned by IT operations, was reviewed under the 10-day SLA. Observation obs_77ad and closure closure_77ad tie the projected 2-path reduction to 2 paths confirmed removed, with 0 of 2 still reaching the asset; verification: SPF/DKIM alignment plus an authorized spoof-delivery check.
Evidence register
Illustrative data — not customer output.
| Stage | Entity | Detail | Evidence | Source | Confidence | Freshness |
|---|---|---|---|---|---|---|
| entry | Exact-domain spoofing | Mail forged as @example.com | inferred | Reachability correlation | 72% | 4 Aug 2026, 08:30 UTC |
| entry | Subdomain spoofing | Mail forged as @billing.example.com | inferred | Reachability correlation | 72% | 4 Aug 2026, 08:30 UTC |
| exposure | SPF soft-fail | ~all lets unauthorized senders through | observed | Passive external observation | 95% | 4 Aug 2026, 08:22 UTC |
| control | DMARC p=none | No reject policy; an authorized test message was delivered | validated | Operator-authorized validation | 97% | 5 Aug 2026, 13:10 UTC |
| asset | Employee inboxes | Internal trust boundary | inferred | Reachability correlation | 72% | 4 Aug 2026, 08:30 UTC |
| asset | Customer inboxes | External brand trust | inferred | Reachability correlation | 72% | 4 Aug 2026, 08:30 UTC |
| impact | Trusted-brand phishing | Messages accepted as the company | inferred | Reachability correlation | 72% | 4 Aug 2026, 08:30 UTC |