It Failed Three Auth Checks, Then Got Whitelisted

A targeted credential‑harvesting spearphishing campaign impersonated the victim organization's own domain; a hosted filtering relay recorded reverse-DNS, SPF and DMARC failures but then marked the message as whitelisted and recommended acceptance, allowing the forged message to be re-injected via the org's on‑prem Exchange and delivered to Microsoft 365 as internal mail. The attack delivered DocuSign-style lure links (shortener domain emj.to), used IP 38.46.218.158 as origin, reached four mailboxes within six minutes, and is part of a series of 39 incidents from the same forged domain with no safe verdicts, demonstrating a systemic control gap where reputation-based allow decisions can override authentication failures.