SPF Passed. DMARC Passed. DKIM Didn't. What That Combination Actually Means.

A targeted business email compromise attempted to collect a W-9 and ACH banking details by impersonating a known financial analyst; SPF and DMARC passed but DKIM body-hash and ARC verification failed, revealing that the message body had been altered in transit through Proofpoint, Barracuda, and Microsoft relays. The report provides IOCs (point72.com domain, two relay IPs, embedded image MD5, and auth-failure headers), assesses the attack as high risk for financial fraud, and recommends tagging DKIM body-hash failures on payment-related emails, monitoring ARC cv=fail, and performing out-of-band verification for banking requests.