DMARC Email Routing Misconfigurations: Are You Accidentally Handing Attackers the Keys to Your Domain?
Most phishing emails are easy to spot, at least in theory. They arrive from suspicious domains, carry obvious lures, and set off filters designed to catch them before they reach the inbox. The attacks making headlines in March 2026 are different. They land from what appears to be your organisation’s own domain, passing through the very email infrastructure you trust, and they carry lures so familiar—shared documents, password resets, HR notifications—that recipients engage without hesitation. The attacker never needed to compromise your systems. They simply found a gap you left open.
Microsoft’s Defender Security Research Team has identified a surge in phishing campaigns exploiting a specific class of vulnerability: misconfigured email routing that allows threat actors to spoof an organisation’s domain with devastating authenticity. The attack doesn’t require sophisticated malware or exploited credentials to begin. It requires something far more common—a mail exchanger (MX) record that doesn’t route directly to Microsoft 365, combined with a DMARC policy that’s too permissive to stop an unauthenticated message.
What makes this particularly unsettling for IT administrators is that the infrastructure involved looks entirely normal. No alarm bells fire. No suspicious external domain appears in the sender field. Instead, the message arrives looking exactly like internal mail because, from a routing perspective, it effectively is—or rather, nothing in the technical chain is positioned to prove that it isn’t.
The campaigns observed by Microsoft researchers leverage phishing-as-a-service (PhaaS) platforms—most notably Tycoon 2FA—to deliver a range of lures at scale. Voicemail notifications. Shared document requests. HR communications. Password expiry alerts. These aren’t opportunistic blasts sent to millions of random addresses. They’re targeted, contextually plausible, and engineered to exploit the trust that recipients naturally extend to mail that appears to originate internally.
How a Misconfigured MX Record Becomes a Phishing Backdoor
The vulnerability begins in the DNS. When an organisation routes its email through an intermediate system—an on-premises mail server, a third-party relay, or a legacy filtering appliance—its MX records point to that system rather than directly to Microsoft 365. This is not inherently dangerous; plenty of organisations operate this way for legitimate reasons, including compliance archiving, DLP inspection, or regional routing requirements.
The problem arises in how Microsoft 365 handles inbound messages arriving via these indirect paths. When mail reaches Exchange Online through a third-party connector rather than the standard MX path, certain native spoofing protections don’t engage in the same way. Specifically, the checks that would ordinarily validate that the sending domain’s SPF record permits the sending IP—and that a DMARC policy with a reject or quarantine action should apply—can behave differently depending on how the connector is configured.
Attackers have mapped this behaviour precisely. By routing messages through a path that triggers the connector rather than the standard inbound flow, they can craft emails in which the recipient’s own domain appears in both the “To” and “From” fields. To the recipient, this looks indistinguishable from an internal message. To many email security systems, including unconfigured or loosely configured M365 tenants, it passes authentication silently.
Tycoon 2FA and the PhaaS Economy Powering These Attacks
Phishing-as-a-service has fundamentally changed the threat landscape by lowering the skill threshold for conducting sophisticated attacks. Tycoon 2FA, one of the platforms Microsoft’s researchers specifically identified in these routing-gap campaigns, is a mature, commercialised toolkit that provides everything an attacker needs: a proxy-based infrastructure designed to intercept multi-factor authentication tokens, a library of convincing lure templates, and a distribution mechanism that handles the technical complexity of delivering phishing mail at scale.
What sets Tycoon 2FA apart from earlier phishing kits is its explicit design around defeating MFA. Traditional phishing steals passwords; Tycoon 2FA and similar adversary-in-the-middle (AiTM) platforms steal authenticated sessions. When a victim clicks a link and enters their credentials on the proxy-served fake login page, the attacker’s infrastructure is invisibly positioned between the victim and the real service. The victim authenticates successfully—MFA prompt and all—while the platform captures the session cookie on the other side. Password resets won’t remediate a compromised session cookie.
The routing-gap technique feeds directly into this model. By making the initial phishing email appear to originate from the victim’s own domain, Tycoon 2FA operators dramatically increase open and click rates. Security awareness training teaches people to scrutinise external senders; an email that appears to come from within the organisation bypasses that conditioned scepticism before the recipient has read a single word.
OAuth Redirection: A Parallel Attack Exploiting Trusted Infrastructure
Running parallel to the routing-gap campaigns is a separate but thematically related technique that Microsoft documented in early March 2026: OAuth redirection abuse. Where the routing-gap attack exploits trust in familiar sender domains, this technique exploits trust in the OAuth authentication protocol itself—the same mechanism that powers single sign-on across thousands of enterprise applications.
OAuth redirection abuse works by crafting malicious URLs using legitimate redirect parameters within trusted OAuth endpoints. Because the URL begins with a domain the recipient recognises—a major cloud provider, a known identity platform—it passes both technical reputation checks and the informal trust evaluation a user applies when scanning a link before clicking. The redirect is only resolved at the point of interaction, at which point the victim is delivered to attacker-controlled infrastructure.
The phishing lures used in these OAuth-based campaigns include e-signature request notifications, financial document alerts, and governmental communications—themes chosen to create urgency and lower analytical resistance. Many of these campaigns have targeted government and public-sector organisations specifically, where the combination of urgency and official-appearing content is particularly effective. The underlying principle shared by both attack vectors is the same: abuse legitimate infrastructure to inherit its trust. Whether that infrastructure is your organisation’s own email routing, a recognised OAuth provider, or a cloud storage platform, attackers are deliberately choosing delivery mechanisms that look authorised because they technically are—just not in the way the recipient assumes.
Why Traditional Defences Miss These Attacks
The conventional email security stack—gateway filtering, reputation-based URL analysis, attachment sandboxing—was largely built around the assumption that phishing comes from outside. Suspicious IP addresses, newly registered domains, malicious attachments with known signatures, links to domains with poor reputation scores. These heuristics work reasonably well against commodity phishing. They work poorly against attacks that borrow the infrastructure of legitimate services.
When a phishing email routes through a trusted third-party connector and arrives with the target organisation’s own domain in the From field, many filters are operating in effectively disabled mode. The message looks internal. The sending IP may belong to a legitimate relay. DMARC, the protocol designed precisely to catch this kind of domain abuse, only functions if an organisation has configured it with an enforcing policy—and research consistently shows that a significant proportion of organisations haven’t.
URL-based defences face similar challenges when attackers embed links that resolve to legitimate domains at click time. A URL pointing to a genuine OAuth endpoint, or a real Google Cloud Storage bucket, passes reputation checks cleanly. The malice is in the redirect, not the link itself. Click-time URL inspection—which Spambrella’s inbound threat protection platform deploys as a standard control—is specifically designed to address this gap by re-evaluating the full URL chain at the moment of user interaction rather than only at the point of delivery. But even click-time protection is tested when the initial destination is a genuinely trusted domain, which is why layered defences and user awareness remain essential components of the overall posture.
Hardening Your Infrastructure Against Routing-Gap and Redirect Attacks
The remediation for routing-gap phishing is well-defined, if not always simple to execute in complex hybrid environments. The first requirement is a strict DMARC policy—reject, not monitor or quarantine. A DMARC policy at the reject level instructs receiving mail servers to discard messages that fail authentication checks against your domain. Without this, a spoofed message that slips through routing gaps has no enforcement mechanism waiting for it on the other side.
Alongside DMARC enforcement, organisations need to audit their SPF records and third-party connector configurations carefully. Every relay, archiving system, or security appliance sitting in the mail path is a potential gap in authentication coverage. Connectors that deliver mail to Exchange Online need to be reviewed to ensure they’re not inadvertently bypassing spoof protection. Microsoft’s guidance recommends that organisations with complex mail paths test their configurations against the specific connector scenarios that attackers are now deliberately targeting—because if you haven’t found the gap, someone else probably has.
Identity hardening is the complementary layer. Since AiTM-based PhaaS platforms like Tycoon 2FA are built to defeat conventional MFA, the only reliable countermeasure is phishing-resistant MFA—FIDO2 hardware security keys or certificate-based authentication that doesn’t involve a user-entered code that a proxy server can intercept. Conditional Access policies that enforce these stronger authentication methods, combined with MFA number matching to prevent notification fatigue attacks, significantly constrain what an attacker can do even if they successfully deliver a phishing email. Spambrella’s security awareness training programs ensure that employees understand not just how to recognise phishing, but why seemingly legitimate authentication flows can still be malicious—a distinction that matters enormously when the attack is designed to look exactly like your own systems.
Email Routing Security: The Bottom Line
Something important has shifted in how attackers approach email phishing. The era of obvious external spoofing is giving way to infrastructure-aware attacks that exploit the gaps organisations create through complex, partly-configured email environments. Routing misconfigurations that seemed like minor technical debt now carry direct, measurable risk—and attackers have built industrialised toolkits specifically to find and exploit them.
For organisations, the immediate priority is DMARC enforcement. Monitoring mode provides visibility; reject provides protection. The gap between those two policies is precisely where campaigns like the ones Microsoft documented in March 2026 operate. Alongside DMARC, a thorough audit of connector configurations and third-party relay paths is no longer optional maintenance—it’s frontline security work. Every element of your inbound mail path needs to be evaluated against the question: could an attacker route a message through this and arrive looking like us?
The forward picture is one where attackers continue to invest in legitimate infrastructure abuse. OAuth redirection, cloud storage as a phishing delivery mechanism, PhaaS platforms that defeat MFA—these aren’t emerging techniques. They’re mature, commercially supported attack methodologies. Organisations that treat email security as a configured-once system will find themselves consistently behind the threat. Those that maintain continuous visibility into authentication posture and routing behaviour—and that partner with providers who actively track these evolving delivery vectors—will be positioned to catch attacks before they become incidents.
Further reading:
The Human Element of Email Security: Understanding Behavioral Threats and Social Engineering
SOURCES:
Microsoft Security Blog — “Phishing actors exploit complex routing and misconfigurations to spoof domains” (Jan 2026)
Microsoft Security Blog — “OAuth redirection abuse enables phishing and malware delivery” (March 2, 2026)
CSO Online — “Microsoft warns of a surge in phishing attacks exploiting email routing gaps” (March 2026)
