Phishing Emails That Pass SPF, DKIM and DMARC: What Changed in 2026

Also on CyberFence: compare CyberFence to other VPNs side-by-side · the free CyberFence security tools .

A Dell order confirmation lands in your inbox. It comes from Dell's real order domain, passes the DKIM and DMARC checks, uses Dell's real template, and confirms a $736.09 purchase you never made. Under "Ship To" sits the word "Helpline" and a phone number. Help Net Security's write-up of new Cisco Talos research explains why the email looks genuine: it is. The attacker typed in only the phone number, and Dell's own system placed it there and sent the message.

This is the quiet shift in phishing this year. The old advice was "look for the fake sender." Now a growing share of phishing comes from real senders, through real platforms, with every technical check passing. Here is what the data shows, how attackers do it, and what still works.

What SPF, DKIM and DMARC Actually Prove

These three checks are the email world's identity system, and they work as designed. SPF checks that the server sending a message is allowed to send for that domain. DKIM checks that the message was not altered after the domain signed it. DMARC checks that those results line up with the domain shown in the "From" line.

All three answer one question: did this domain's infrastructure send this message? They do not answer whether the content is honest. As security firm Ironscales puts it in an analysis of real domains attackers borrow, when a platform sends mail on behalf of an account the attacker created or compromised, the platform did exactly what it was built to do, and every check passes.

The Numbers

• 84.4% of successful phishing attacks now pass DMARC, according to KnowBe4's 2026 Phishing Threat Trends Report, Vol. 7.
• 22% of phishing attacks are now sent through a legitimate platform, in KnowBe4's data, with attackers moving from impersonating a brand to abusing that brand's actual infrastructure.
• About 1 in 10 threat emails KnowBe4 tracked from June to August 2026 used this technique. In its sample of 544,000 threat emails, 53,000 relied on legitimate-service abuse, and the document-share lure was the largest single theme at 39.2%.
• More than 25 platforms were abused over the past year, Cisco Talos reports, spanning collaboration, file-sharing, survey, payment and AI services.

One small field report is worth mentioning, with the caveat that it is a single inbox and not a market-wide study. Keepnet Labs looked at 27 SendGrid-themed phishing emails that reached one inbox: all 27 passed SPF, 26 passed DKIM, and none failed DMARC.

How Attackers Borrow Trust

1. Fake support numbers in real receipts

Cisco Talos described two campaigns totaling roughly 1,400 messages that abused Staples and Dell transactional mail. Attackers put a fake support number into a user-controlled field, such as billing or shipping, when placing an order. The retailer's system then sent its own genuine confirmation containing that number. The goal is not a click but a phone call, which moves the victim off email, where filters and warnings no longer apply.

2. List bombing and welcome emails

Attackers sign victims' email addresses up to legitimate registration, subscription or notification forms. The victim gets a flood of automatic confirmation emails, and in some cases a lure typed into the name, company or title field is delivered inside the platform's own welcome message.

3. Bounce messages

A delivery failure notice can echo the original message back to the sender. Talos observed a failure notice carrying a WeTransfer-themed file-sharing lure. In their words, users are conditioned to see system errors as benign and are far more likely to engage with an "administrative" fix than with a suspicious standalone phishing email.

4. Real invites, forms and shares from compromised accounts

Ironscales documented a Microsoft Forms invitation to an "Adobe Acrobat Pro Usage Assessment" that came from a compromised Microsoft 365 account at a real technology services firm, passed SPF, DKIM and DMARC, and earned Microsoft's highest composite authentication score. Other examples used DocSend shares and invitations sent through a real events platform. Calendar invites are a related route: Check Point identified large campaigns using fake meeting invites to steal Microsoft account credentials, and, as one security researcher pointed out, a malicious meeting can still land on your calendar even if the email that carried it was quarantined.

Why It Works on People

When the email passes every check, comes from a brand you know and looks like a receipt, your own instincts are the last filter. Attackers know that and design for it: urgency, an unexpected charge, a number to call. The callback format is especially hard for software to stop because the harmful part happens on a phone call.

Platforms and email gateways are being asked to adapt too. Talos recommends that platform owners reject or flag phone numbers, URLs and urgent support language in fields where they do not belong, and that gateways inspect the fully rendered message instead of just the sender and template.

Why Filters Struggle

Email filters grew up on a simple idea: unknown or forged senders are risky, known and authenticated senders are safe. Attackers who send through trusted platforms flip that logic. The sender reputation is excellent, the links often point to well-known sites, and the wording comes from a genuine template. Security vendors are adding checks that read the whole rendered message and follow redirect chains, but the shift matters for anyone who still relies on a "verified sender" badge or a clean spam score as a sign of safety. Treat authentication as one signal among several, never as a verdict.

What Still Works for You

1. Verify out of band. If an email says you were charged, do not call the number in it. Open the retailer's app or type its address yourself and check your account.
2. Treat unexpected receipts as a warning sign. Talos advises checking whether transactional mail fits the process that generated it. A receipt with an unexpected support number, cancellation instructions or urgent language should raise flags.
3. Look at the relationship, not the logo. Check the Reply-To address and what the message wants you to do. A receipt that pushes you to call a number you did not look up yourself deserves a pause.
4. Be careful with invites and shares. An unexpected form, document share or meeting invite from someone you do not know is a prompt to stop, even if it came through a trusted service.
5. Open links in a fresh tab you type yourself when money or logins are involved.
6. Use multi-factor authentication, ideally passkeys, on email, banking and work accounts, so a stolen password alone is not enough.
7. Never share one-time codes with anyone who contacts you, however official they sound.
8. Report it. Forward suspected phishing to your IT team or your email provider's report tool so others are protected.

If You Run a Small Business

Do not treat a passing DMARC result as a safety stamp when you train your team. Teach people to ask what the message wants them to do, and who really sent it. Make it easy and expected to report odd receipts, invites and shares, and turn on multi-factor authentication for every account that touches money or customer data. If your email gateway can inspect the full rendered message and the redirect chain of every link, that is worth switching on, since the sender check alone will not catch these.

Where CyberFence Fits

No VPN reads your email, and none can tell you whether a receipt is real. Where CyberFence helps is later in the chain:

• Known phishing pages. Web Shield is CyberFence's DNS-level filter. It blocks known malware and phishing domains before they load, even if you tap the link. It works from lists of known bad sites, so a brand-new page, or a malicious page hosted on a legitimate platform, can still get through. See how DNS filtering works and whether a VPN protects from phishing.
• Your logins on shared Wi-Fi. The AES-256-GCM encrypted tunnel protects what you send on networks you do not control, which matters for the sign-ins phishing is trying to get.
• Leaked credentials. Breach Monitor, a separate CyberFence product that is not part of the $7.99 plan, alerts you when your email shows up in a known breach. See credential stuffing attacks and what Breach Monitor is.

For related reading, see how AI is changing phishing, how session-stealing phishing kits work, and the Microsoft phishing kit takedown.

The Takeaway

"Looks legitimate" is no longer evidence, because in a growing number of cases it is legitimate infrastructure delivering an illegitimate request. The habits that work are the plain ones: verify through your own channel, slow down on urgency, protect logins with strong authentication, and keep layers like DNS filtering behind you for the pages that do slip through.

Want to go deeper? Read the CyberFence competitor comparison hub , our free privacy and security tools , or CyberFence plans and pricing .