Spoofed LinkedIn Alert Rides an ARC Seal Past DMARC

A message that fails a p=reject DMARC policy is supposed to be dead on arrival. This one landed in the inbox of a Digital Marketing Manager at a consumer goods and marketing communications firm anyway.

The email spoofed LinkedIn's notification address, messages-noreply[@]linkedin[.]com, and it did not authenticate as LinkedIn in any meaningful way. SPF returned a softfail, because the sending IP was not authorized to send on LinkedIn's behalf. DKIM was absent entirely. DMARC failed against LinkedIn's published policy of p=reject, and the receiving path logged the action as oreject. By every signal LinkedIn publishes to protect its own brand, this message should have been rejected outright.

It reached the inbox because something downstream vouched for it. A Mimecast relay in the delivery path applied an Authenticated Received Chain (ARC) seal, and Microsoft's gateway trusted that seal and delivered the message. That is the entire attack in one sentence: relay trust beat sender authentication.

A LinkedIn envelope wrapped around a DocuSign lure

The subject line followed LinkedIn's familiar notification pattern, referencing a document shared by the recipient's own employer. That framing is designed to feel routine. A LinkedIn alert about internal activity is the kind of email a busy marketing manager clicks without a second thought.

Then the body contradicted the envelope. Instead of a LinkedIn message preview, the recipient saw a DocuSign-branded "document review" request, complete with a review-and-sign call to action. This is a mismatched brand narrative: the sender identity claimed one platform, the content impersonated another. Real notifications do not do that. LinkedIn does not send DocuSign envelopes, and DocuSign does not send from LinkedIn's notification address.

The tell that ties it together is where the logos came from. Both the LinkedIn and the DocuSign brand images were loaded from imgbox[.]com, a free public image host, rather than from either company's own content delivery network. Legitimate LinkedIn and DocuSign mail serves brand assets from company-controlled infrastructure. When a logo in a "trusted brand" email resolves to a generic third-party image host, that is not a rendering quirk. It is a fingerprint of a kit assembled from borrowed parts. This maps cleanly to MITRE ATT&CK T1036.005, Masquerading: Match Legitimate Name or Location.

The auth verdict that got laundered

Sender authentication did its job. SPF, DKIM, and DMARC all told the truth: this was not LinkedIn. The failure was not in the standards. It was in how the receiving gateway weighed a downstream ARC seal against the original verdict.

ARC exists for a good reason. Mailing lists, forwarders, and security relays legitimately modify messages in transit, which breaks SPF alignment and DKIM signatures for mail that is otherwise genuine. ARC preserves the earlier authentication results so a final receiver can see that a message was clean before an intermediary touched it. The problem is trust. If a gateway treats an ARC seal from a known relay as a reason to deliver, an attacker only needs to route spoofed mail through a relay that the receiver trusts. The relay's reputation becomes a laundering service for the sender's failed authentication.

That is exactly what happened here. The message failed DMARC, an ARC seal from the Mimecast relay carried it forward, and Microsoft's gateway delivered it. The call-to-action link was even rewritten by Mimecast and Safe Links URL protection and marked Clean, which added a second layer of false reassurance for the recipient.

Underneath the wrappers, the infrastructure told the real story. The sending IP 107[.]173[.]187[.]9 had a PTR record of email128[.]104927129[.]tel, pointing at a newly registered, privacy-protected .tel domain whose sending subdomain does not even resolve in public DNS. Acquiring throwaway, privacy-shielded domains for a campaign like this is T1583.001, Acquire Infrastructure: Domains. The credential-harvesting link itself is T1566.002, Spearphishing Link.

Why the pass or fail switch was never enough

This case is a clean argument against using a single authentication verdict as the automated gate. DMARC gave the correct answer and the mail was delivered anyway. The 2024 Verizon Data Breach Investigations Report (DBIR) found that the median time to click a phishing link is 21 seconds, and to submit data 28 seconds, so once a lure like this reaches a real inbox, the window to catch it is measured in seconds, not hours. The same report notes phishing was present in 15% of breaches, and the Microsoft Digital Defense Report 2024 documents the continued scale of brand-impersonation phishing as a primary intrusion vector.

Our Adaptive AI, Themis, does not treat the authentication verdict as the end of the analysis. It reads the message the way a trained analyst would. The From identity claims LinkedIn while the body impersonates DocuSign, a brand-narrative mismatch. The brand logos load from a public image host instead of a real CDN. The original sender authentication failed even though a relay ARC seal carried the message through. Each of those signals is independent of the ARC seal that fooled the gateway, and together they build a high-confidence verdict that authentication alone would have missed. That is the model that lets IRONSCALES serve 35,000+ security professionals across 17,000+ organizations, and it matters because SEGs (secure email gateways) miss an average of 67.5 phishing emails per 100 mailboxes each month.

See Your Risk: Calculate how many threats your SEG is missing

For teams layering IRONSCALES on top of Microsoft, this is precisely the M365 augmentation gap that behavioral analysis is built to close. The gateway made a defensible decision to honor an ARC seal. The defense that catches it lives one layer up, in content and context.

Stop trusting the relay more than the sender

Audit how your gateway handles ARC. If a trusted relay's ARC seal can override a DMARC fail on a brand like LinkedIn that publishes p=reject, you have a delivery path that attackers can rent. The 2024 Verizon DBIR puts the human element in 68% of breaches, and CISA's phishing guidance is blunt that impersonation of trusted brands remains one of the most effective initial-access techniques. Treat authentication as one input, not the verdict. Weight brand-narrative consistency and, specifically, where brand assets are hosted, because a logo pulled from a public image host instead of a real CDN is one of the most durable tells a phishing kit leaves behind.