Re: docusign/adobe spark/sendgrid phish

2021-01-28 Thread Bill Cole
On 28 Jan 2021, at 8:01, Alex wrote: Hi, This message passes DKIM for adobespark.com and hits the sendgrid SPBL rule, but also USER_IN_DEF_SPF_WL. I'm trying to understand how this message was not caught and how it was allowed to apparently manipulate these services. Clearly the reason it was

docusign/adobe spark/sendgrid phish

2021-01-28 Thread Alex
Hi, This message passes DKIM for adobespark.com and hits the sendgrid SPBL rule, but also USER_IN_DEF_SPF_WL. I'm trying to understand how this message was not caught and how it was allowed to apparently manipulate these services. What is the attachment included in the email? https://pastebin.co