<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-email-authentication-monitoring
description: >-
  Monitor and analyze email authentication (SPF, DKIM, DMARC) aggregate and
  forensic reports to detect unauthorized senders, configuration drift,
  authentication failures, and domain spoofing attempts in real time.
domain: cybersecurity
subdomain: phishing-defense
tags:
  - dmarc-monitoring
  - spf-monitoring
  - dkim-monitoring
  - aggregate-reports
  - forensic-reports
  - email-authentication
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1566.001"]
---

# Implementing Email Authentication Monitoring

## Overview

Email authentication monitoring goes beyond initial SPF/DKIM/DMARC deployment
to continuously analyze aggregate (RUA) and forensic (RUF) reports, detect
authentication failures, track authorized sender coverage, identify shadow IT
sending services, and alert on spoofing attempts.

## Prerequisites

| Requirement | Install |
|---|---|
| Python 3.10+ | Agent tooling runtime |
| `xmltodict` | `pip install xmltodict` — XML parsing |
| `pandas` | `pip install pandas` — data analysis |
| DMARC RUA inbox | Mailbox receiving aggregate reports |

## Key Concepts

### DMARC Report Types

| Type | Tag | Content | Frequency |
|---|---|---|---|
| Aggregate (RUA) | `rua=` | Summary stats per source IP | Daily |
| Forensic (RUF) | `ruf=` | Individual failure details | Per-failure |

### Authentication Result Matrix

| SPF | DKIM | DMARC Alignment | Result |
|---|---|---|---|
| pass | pass | aligned | PASS — legitimate sender |
| pass | fail | SPF-aligned | PASS — DKIM issue to investigate |
| fail | pass | DKIM-aligned | PASS — SPF record needs updating |
| fail | fail | none | FAIL — potential spoofing |

### Key Metrics

| Metric | Target | Description |
|---|---|---|
| DMARC pass rate | > 99% | Percentage of aligned messages |
| Unknown sender volume | < 1% | Messages from unrecognized sources |
| SPF record coverage | 100% | All legitimate senders in SPF |

## Workflow

### 1. Parse DMARC Aggregate Reports

```bash
node agent.js parse-rua --report /tmp/dmarc_report.xml
node agent.js batch-parse --report-dir /tmp/dmarc_reports/ \
  --output /tmp/parsed_results.json
node agent.js failing-sources --report /tmp/dmarc_report.xml
```

### 2. Sender Inventory

```bash
node agent.js sender-inventory --report-dir /tmp/dmarc_reports/ \
  --known-senders /tmp/authorized_senders.txt
node agent.js shadow-senders --report-dir /tmp/dmarc_reports/ \
  --known-senders /tmp/authorized_senders.txt
```

### 3. Alerting and DNS Audit

```bash
node agent.js check-threshold --report /tmp/dmarc_report.xml \
  --max-fail-rate 0.05
node agent.js audit-dns --domain company.com
node agent.js generate-sigma --detection-type dmarc-failure
```

## Detection

```yaml
title: Email Authentication Monitoring Detection
id: 790289cf-188a-4f75-bd92-4a1b998b2b55
status: experimental
description: Detects suspicious activity related to implementing email authentication monitoring techniques in phishing defense context
logsource:
  category: email
  service: o365
detection:
  selection:
    Subject: "*urgent*"
  condition: selection
level: high
tags:
  - attack.t1566.001
  - attack.initial_access
falsepositives:
  - Security awareness training platform sending simulated phishing emails
```

## Verification

| Check | Method |
|---|---|
| RUA reports parsed | XML converted to structured JSON |
| Failure sources identified | IPs with DMARC fail extracted |
| Sender inventory built | Known vs unknown senders categorized |
| Threshold alerts working | High failure rate triggers alert |
| DNS records audited | SPF/DKIM/DMARC records validated |

## References

- [RFC 7489 — DMARC](https://datatracker.ietf.org/doc/html/rfc7489)
- [RFC 7208 — SPF](https://datatracker.ietf.org/doc/html/rfc7208)
- [Google DMARC Report Documentation](https://support.google.com/a/answer/10032169)
- [Dmarcian DMARC Tools](https://dmarcian.com/)
