Headers: Reserved domain in Message-ID

calendar Oct 26, 2026 · Attack surface reduction  ·
Share on: linkedin copy

Detects inbound messages where the Message-ID header contains a reserved or placeholder domain (such as example.com/net/org or a subdomain ending in .test, .invalid, .example, or .localhost). These domains are set aside by RFC standards for documentation and testing purposes and should never appear in legitimate production mail headers, making their presence a strong indicator of spoofed or synthetically generated messages.

Sublime rule (View on GitHub)

 1name: "Headers: Reserved domain in Message-ID"
 2description: "Detects inbound messages where the Message-ID header contains a reserved or placeholder domain (such as example.com/net/org or a subdomain ending in .test, .invalid, .example, or .localhost). These domains are set aside by RFC standards for documentation and testing purposes and should never appear in legitimate production mail headers, making their presence a strong indicator of spoofed or synthetically generated messages."
 3type: "rule"
 4severity: "low"
 5source: |
 6  type.inbound
 7  and regex.icontains(headers.message_id,
 8                      '@(?:example\.(?:com|net|org)|[^@]*\.(?:test|invalid|example))>?$'
 9  )  
10tags:
11  - "Attack surface reduction"
12attack_types:
13  - "Spam"
14  - "BEC/Fraud"
15tactics_and_techniques:
16  - "Spoofing"
17  - "Evasion"
18detection_methods:
19  - "Header analysis"
20id: "b44139a4-a031-5c55-afaa-df98eff5efd3"

Related rules

to-top