A spoofing complaint is a lead, not a complete technical finding. The reporter may have seen a misleading display name, a lookalike address, a forwarded message or a compromised legitimate account. Respond by preserving what they observed, identifying missing evidence and protecting any affected business action. Do not change domain policy merely because a screenshot contains the company name.
Collect the smallest useful evidence set
Ask for the original message using an approved secure channel when possible, along with the approximate receive time, affected mailbox and description of the requested action. Preserve the original before redaction. Record who supplied it, when it was acquired and whether it came directly from the receiver or through an intermediary. A forwarded body may omit headers that are essential to the investigation.
Keep original evidence under appropriate access control. Create a separate sharing copy that removes unnecessary recipient details, personal content or unrelated attachments while retaining relevant identity fields. Hash both files and document the redactions so a reviewer can understand why their bytes differ. Hashes bind a record to bytes; they do not prove that the content is authentic or that the sender was identified correctly.
Identify the trusted authentication evidence
Find the system that evaluated the message at receipt. An Authentication-Results field is meaningful only within its established trust boundary, as RFC 8601 explains. Authentication Results. A generated or untrusted header should not be promoted into a receiver observation simply because it uses a valid format.
Compare From, envelope and DKIM identities without conflating a passing signature with business approval. DMARC addresses aligned domain authentication rather than all forms of impersonation. RFC 9989. If the original message or trusted logs are unavailable, keep the outcome unresolved and describe what additional evidence would change it.
Build a hypothetical incident ledger
For teaching case DEMO-COMPLAINT-01, assume a complainant reports a payment-change request with visible From billing@brand-pay.test. Actual message bytes, receiver timestamps, trusted authentication results and customer details are not supplied. Record original hash as unavailable, not as an invented digest. Classification remains provisional until the relevant evidence is obtained.
Assign proposed next actions separately: mail operations obtains the approved original export and trusted receiving context; finance verifies the request through a known channel; the incident lead authorizes any necessary sharing or containment. These are illustrative roles, not real people who accepted assignments.
For a later real sharing copy, log the original reference, each redacted field, purpose, recipient, approval and resulting file hash. Keep the original immutable. A changed hash can identify changed bytes, but cannot establish who authored the message or a chain of custody that was never recorded. No original file, redacted specimen, hash computation or external incident action was performed for this written example.
Respond with a bounded finding
A useful acknowledgement states what has been received, what remains unknown and who is investigating. Avoid accusing a supplier or promising the issue is fixed before identity and route evidence support that conclusion. If money or credentials may be at risk, follow the organization's incident process promptly while evidence collection continues. The FBI recommends independent verification of payment requests and account changes. FBI guidance.
Give each missing item an owner and a next action. The mail team can retrieve receiver logs, the business team can verify the request and the security lead can coordinate containment. Keep external sharing within approved scope, especially when the original contains sensitive information.
Close only the conclusions supported by evidence. A confirmed lookalike request may be classified while provider attribution remains unresolved. A repaired legitimate sending route may close the authentication defect without resolving the business harm. Preserve those distinctions in the final incident package so the next reviewer does not mistake a partial finding for a complete resolution.
Keep findings within the evidence
The examples are defensive decision aids, not observed allegations against real people or current providers. Retain authentication evidence, business verification and attribution separately. Current protocol sources describe domain validation and trusted result boundaries; they do not supply the missing account evidence or authorize publication of an accusation.