Why Are Legitimate DocuSign Emails Triggering Highly Malicious Link Alerts?
Asked by
MellowCedar47
Has anyone else seen legitimate DocuSign messages trigger highly malicious link alerts in a GCC tenant? We are seeing this across many incoming messages, including mail sent through our organization's DocuSign account, and the volume has made it difficult to separate genuine signing requests from phishing attempts.
Answers
There are ongoing business-email-compromise campaigns that abuse DocuSign branding and sending infrastructure. Check authentication results, especially SPF and DMARC, and quarantine messages that fail validation. We’ve seen a large number of messages from the domain quarantined over the past month.
Reply to this answer
This has been happening intermittently for years and became more noticeable again recently. In our case, some messages were blocked because the SPF record did not validate, so reviewing the headers and the exact sending path is worthwhile.
Reply to this answer
Yes, we’re seeing the same behavior. Nearly every DocuSign message entering the organization is being flagged, which is especially disruptive when you receive hundreds of them each day.
Reply to this answer
DocuSign’s sending reputation appears to have taken a hit. We saw several phishing attempts per day from their domain over the summer, although the volume has eased recently. Treat the alerts seriously rather than automatically allowing the messages.
Reply to this answer
Add your answer
Answers are reviewed before publication.
MellowCedar47: That matches what we’re seeing. The alerts also affect messages generated from our own DocuSign account, so it does not appear to be limited to random spoofed senders.