The DKIM Passed. Nobody Spoofed Anything.

**Executive summary:** A credential-harvesting phishing message authenticated with stolen mailbox credentials on a Japanese small-business Postfix server was auto-forwarded by a Microsoft 365 partner into a European insurer's Google Workspace admin group, re-signed and delivered to the Chief Revenue Officer; DKIM/SPF/ARC passed while DMARC failed for the external From domain, and the email contained a two-word body and a single malicious redirect link to an Azure Front Door host. The report provides IOCs, authentication and ARC trace analysis, MITRE mappings (T1566.002, T1078, T1036.005), and advises auditing partner auto-forwards and group posting policies while not mistaking a DKIM pass on your own key for message trust.