Can a phishing email pass SPF, DKIM, and DMARC checks?

Yes. Attackers sign up for legitimate services and send phishing through those platforms. Because the email is genuinely sent by the trusted service's infrastructure, all email authentication checks pass. SPF, DKIM, and DMARC only confirm that the sending domain is real — not that the message content is legitimate.

What are the red flags of a verified phishing email?

Key red flags include: brand and sender mismatch (e.g. ChatGPT notification from OneLogin), urgent or alarming language designed to create panic, a call-to-action that is a button or link rather than instructions, grammar or formatting mistakes, and suspicious timing such as weekends or holidays.

What should I do if I receive a suspicious verified email?

Do not click any links or buttons. Go directly to the service's official website by typing the URL manually. Report the email to your IT or security team. Check the sender address carefully for mismatches. If in doubt, contact the supposed sender through a separate, verified channel.

🎓

Security Awareness Training

Stay Sharp.
Stay Secure.

Real-world threat intelligence and practical security awareness training from the Bitswift cybersecurity team. Because the best firewall is an informed team.

← Back to Cyber Security 🔒 Request Training

user@bitswift :~$ awareness --latest-posts

threat intelligence feed

Latest Awareness Posts

Bite-sized lessons from real threats our team catches, analyzes, and neutralizes.

Nov 7, 2026 Phishing Email Security

When "Verified" Email Is Still Phishing

Attackers are sending phishing emails through real, trusted services. These emails pass SPF, DKIM, and DMARC checks — meaning standard email authentication won't catch them. A verified sender does not mean a safe message.

Read full post →

← Back to all posts

Security Awareness: When “Verified” Email Is Still Phishing

Nov 7, 2026 · Prepared by Bitswift Technology Solutions

Phishing Email Security SPF / DKIM / DMARC

The short version: Attackers are sending phishing emails through real, trusted services. These emails pass SPF, DKIM, and DMARC — meaning standard email authentication won't catch them. A verified sender does not mean a safe message.

A Real Example We Caught

A user received an email that appeared to come from ChatGPT Account Team, sent from the address noreply@onelogin.com. The subject line read "Access token granted."

Every standard authentication check passed — SPF, DKIM, and DMARC all returned clean. The email looked legitimate. It claimed a new access token had been added to the user's account and urged them to click "Remove this token" if they didn't recognize it.

The button didn't go to ChatGPT or OneLogin. It led to a credential-harvesting page designed to steal the user's login credentials.

How It Got Through

Sign-up: The attacker signs up for a free account on a legitimate platform (in this case, OneLogin).
Template abuse: They edit the platform's notification template — changing the display name, body text, and embedded links.
Send via the platform: The phishing email is sent through the platform's own mail servers, using its real infrastructure.
Authentication passes: Because the email genuinely originates from the platform's servers, all SPF, DKIM, and DMARC checks pass.

The Red Flags in This One

Brand/sender mismatch: The email claimed to be from ChatGPT, but came from a OneLogin address. Legitimate services send from their own domain.
Creates alarm: The message tried to create urgency — "someone has access to your account" — to push the user into clicking without thinking.
The fix is a button in the email: Real security alerts tell you to log in to your account directly. They don't embed "fix it now" buttons in the email itself.
Small grammar mistakes: The phrasing was slightly off — not dramatically wrong, but enough to notice if you're reading carefully.
Arrived on a weekend: Social engineers often time messages for when people are less alert or when IT support isn't immediately available.

What to Do

Don't click on unexpected security alerts. If you receive an alert you didn't trigger, don't click any links in it. Go to the service directly by typing the URL into your browser.
Check the real sender address. Look at the actual email address, not just the display name. If the domain doesn't match the service the email claims to be from, it's suspicious.
Ask yourself: "Would this company actually send me this?" If a service you don't use sends you an account alert, that's a red flag.
Report it. Use the "Report phishing" button in your email client. This helps your security team and improves filtering for everyone.
If you already clicked: Change your password immediately, enable multi-factor authentication if you haven't, and notify your IT team or contact Bitswift.

Remember: SPF, DKIM, and DMARC only confirm that the email came from the domain it claims to. They do not confirm that the email is legitimate or safe. When in doubt, don't click — go to the source yourself, or ask us.

Stay Sharp.Stay Secure.