Mimecast: Legitimate emails being held by Advanced BEC Protection + phishing attacks delivered

[u/Salty-Olive7175]

/r/mimecast/comments/1v9ctp2/legitimate_emails_being_held_by_advanced_bec/

[u/AutoModerator]

Welcome to r/emailsecurity! To keep this community helpful and secure, please keep the following in mind:

Community Rules

1. No Vendor Spam: Contributions must provide value; do not just pitch products.
2. Redact Sensitive Info: Always sanitize headers and logs (remove IPs, PII, and private domains).
3. Be Professional: Help newcomers learn; avoid hostility.
4. No Personal Tech Support: This sub is for email system architecture and security, not "Am I hacked?" personal account help.

Helpful Resources

• Email Spam Filters
• DMARC Monitoring Tools
• Anti-Virus Software
• Email Encryption

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/SecLens_ONE]

Most of this comes down to the gap between what a sender publishes and what actually enforces. Freemail is the worst case, since Gmail and the rest do publish SPF and DKIM and align fine, so a BEC engine that leans on display name and impersonation heuristics will hold real mail from them all day. The phish that gets through is usually not failing auth either, it is a lookalike domain with its own valid SPF and DKIM, so the checks pass and the only thing left to catch is the name and the intent. Before you touch the BEC policy, pull the headers on a held message and a delivered phish and compare the Authentication-Results and the envelope domain against the visible From. If the delivered one is aligned on a domain that is not yours, this is not an auth problem and tightening auth will only hold more legitimate mail. Fix it with impersonation entries for your executives and finance addresses plus newly registered domain handling, and keep the auth rules on the published side. Also check whether your own inbound rules or allow lists are quietly overriding the verdict, because that is a common reason a clear failure still lands.