Exchange Email Spoofing Verification

I run our mail flow through Microsoft Exchange and need a specialist to take a deep dive into the raw metadata of several suspicious messages. The immediate goal is to verify every relevant indicator—sender address, full header chain, DKIM signatures, DMARC alignment, SPF results (including the “Received-SPF” lines)—so I can confidently rule out or confirm any spoofing attempts.

The review must look at all common vectors: email-address spoofing, domain spoofing, IP spoofing, and any other irregularities you spot in the trace. Once you have the evidence, I’d like a concise report that explains what happened, how you proved it, and what corrective actions or policy tweaks (e.g., updated SPF include, DKIM key rotation, stricter DMARC policy) you recommend. A short call to walk through the findings would be helpful but isn’t mandatory if your documentation is crystal clear.

Deliverables
• Annotated header analysis for each message examined
• Verification results for DKIM, DMARC, and SPF, with pass/fail reasoning
• Summary of detected spoofing (or proof of legitimacy) with screenshots/log extracts
• Actionable remediation steps, prioritised

I’m happy to supply the .eml files and current TXT records as soon as we start.