Greatness PhaaS — safe-sender allow-list bypass with failed authentication

Ankit Mehta@Secvyn

•updated Aug 5, 2026•2•0•4

This rule detects potential phishing emails that successfully pass through to the mailbox despite failing SPF, DKIM, or DMARC authentication checks. It specifically flags emails that claim to originate from high-value vendor domains (e.g., DocuSign, Zoom, Adobe, RingCentral) but contain links to external domains that do not match the alleged sender's domain, which is a common indicator of brand impersonation or credential harvesting campaigns.