Project 51: Phishing Campaign Defense

Module: Module 6: Applied Web Security & Defensive Automation  |  Level: Intermediate  | 
Primary tool: Your own sandboxed mail testing account  |  Estimated time: 75–120 minutes

Objective: Analyze the technical anatomy (headers, SPF/DKIM/DMARC) of a phishing email safely.

Free lab environment

Your own free-tier mail domain (e.g. via a free Mailtrap/Mailgun sandbox) — https://mailtrap.io/

Use a sandboxed email-testing service (free tier) so test messages never reach a real inbox. Never send spoofed mail to a real third-party address as part of this course.

Lab workflow

1. Set up Your own sandboxed mail testing account so no test message can ever reach a real inbox.
2. Using your sandbox, work through the exercise with the specific goal of learning to analyze the technical anatomy (headers, SPF/DKIM/DMARC) of a phishing email safely.
3. Inspect the raw email headers (not just the rendered message) — this is where the real evidence lives.
4. Identify the specific authentication result (SPF/DKIM/DMARC pass/fail) and what it means.
5. Write the specific configuration change (policy, record, or setting) that would close the gap you found.
6. Capture the screenshots specified below as your evidence trail.

Evidence & screenshot requirements

Submit the following with your report (see this module’s practical assignment for exact upload details):

• your annotated email-header analysis, highlighting the SPF/DKIM/DMARC result
• your written explanation of what a correctly configured DMARC policy would have done to that message

Expected deliverable

A concise lab-report entry containing: scope/target, exact commands or payloads used, your key
observation, the required screenshots above, and — where applicable — the specific remediation for what
you found. Vague answers (“sanitize input”, “use a firewall”) without naming the exact mechanism will not
receive full credit.

Safety & authorization

Only test the specific free lab target named above, or infrastructure you personally own. Do not target
third-party systems, real user accounts, or production services without explicit written authorization.
Never deploy anything from this project outside an isolated lab environment.