A suspicious email went to my spam folder, but I didn't see the domain error warning I've seen on other messages. The sender's domain appears to belong to a real company.
Can the address still be spoofed without an obvious header error, or does that suggest the company's email was compromised?
Yes. No warning doesn't prove the sender was genuine. A domain might not have useful authentication records or a DMARC policy, and the receiving provider may not display every failed or missing check as a warning.
Look at the Authentication-Results header added by your receiving provider. SPF checks whether the sending server is authorized for the envelope sender domain, while DKIM checks a cryptographic signature for a signing domain. DMARC checks whether a passing SPF or DKIM result aligns with the domain in the visible From address.
A DMARC pass is stronger evidence that the message was authorized by that domain, but it doesn't establish that the message is safe or that the person named in From actually sent it.
A compromised mailbox is another possibility. If someone sends through the company's real mail service, SPF, DKIM and DMARC can all pass even though the message is a scam.
That still doesn't tell you a compromise happened here. A legitimate account could also send a misleading message, or the sender could control a different domain that only looks like the company's.
p81.memcfg:
So even a clean authentication result wouldn't tell me whether the account owner intended to send it?
~dazzle+without!sequins:
Right. The checks authenticate aspects of the sending domain, not the intent of the person using the account.
There are also mail systems that let an authorized user or relay submit mail with another address in From without checking that the user is allowed to use that address. Depending on the configuration, the message could then be sent and authenticated by the domain's own infrastructure.
That's different from an outsider simply forging a From address. The headers alone may not tell you which account or internal relay submitted it.
I'd check the full address, not just the display name, and compare the domain carefully with the company's independently found contact details. A real domain can still be unrelated to the claimed sender.
Spam filtering and authentication are separate things. A message can pass authentication and still land in spam because of its content or other signals. If it asks for money or sensitive information, contact the company through a channel you find independently rather than replying to the message.
Answers are reviewed before publication.
2k__hashwin:
Also check which server added the Authentication-Results header. A header supplied by the sender isn't something you should trust on its own.