[drop_cap]M[/drop_cap]ost scam and phishing emails these days get flagged pretty consistently by inbox providers. Your run-of-the-mill bad actor blasts their missive over disposable VPS boxes or compromised machines until IP reputation gets burned. Eventually Gmail or Yahoo just puts them onto a blocklist, so you won’t even see them in your spam folder anymore, they just get dropped entirely.

The principle is simple: if enough emails land in spam automatically or get placed there manually by enough users, it’s usually game-over fast.

Works pretty well.

Recently I ran into an interesting outlier. There was a consistent phishing campaign hitting a 20+ year old email of mine with 10 or so emails every single day. And yes, the filters were screaming bloody murder:

X-Spam-Level: **********
X-Spamd-Bar: ++++++++++
X-Spam: Yes

But they kept on coming, day by day, over a span of 3-4 weeks.

Eventually I got tired of watching my spam folder fill up by the same bone-headed credit card harvesting spam. Fun fact: Gmail filters don’t apply on the spam folder, so no easy way to perma-delete.

So I investigated the raw email headers more deeply.

Relays All The Way Down

The first thing I noticed was that all of them were actually passing DKIM, two signatures per email. The scammers weren’t hacking enterprise mail servers or stealing private keys. They were doing something much simpler:

  1. A victim domain once authorized a relay provider (like DNSExit or EmailsWave) to send email on its behalf, typically via a CNAME delegation in their DNS. Important detail: the DKIM private key lives on the relay provider’s servers, not the domain owner’s.
  2. The spammer somehow gets access to that relay account via leaked credentials, brute-forced, etc.
  3. They plug those relay credentials into their own relay, in this case a Mailgun account, and start blasting. The relay signs with the victim’s domain, and Mailgun provides the delivery infrastructure, clean IPs, high reputation, its own second DKIM pass layered on top.

That’s it. No DNS writes. The victim authorized the relay years ago and now another relay acts as the firehose.

Here’s what my receiving mail server actually saw in every single email:

Authentication-Results: mx.example.net;
    dkim=pass [email protected];
    dkim=pass [email protected];
    dmarc=pass header.from=victim-domain.example;

Two valid DKIM signatures, one perfectly aligned with the sender domain. As far as the filter is concerned, this is authenticated mail, with a bow on top.

That explained the how. But who was behind this?

The spoofed from header and the signing domain rotated with every email, but underneath, they always came from the same one or two X-Mailgun-Sid values, which meant the same bad actor was behind all of it.

These generally look something like this:

X-Mailgun-Sid: WyJhMWIyYzMiLCJldmlsLW9wZXJhdG9yQHNjYW1yaW5nLmNvbSIsImY0ZTVkNiJd
Looks like base64, right? Yup. Fully decoded, it’s just basic JSON:

echo -n "WyJhMWIyYzMiLCJldmlsLW9wZXJhdG9yQHNjYW1yaW5nLmNvbSIsImY0ZTVkNiJd" | base64 -d

["a1b2c3","[email protected]","f4e5d6"]



"X-Mailgun-Sid header is currently used to process complains [sic] received via feedback loops." - Mailgun docs


While Mailgun doesn’t publish the internal structure of X-Mailgun-Sid we can still glean some interesting bits from our decode. The first and the last part are probably hashed campaign ids or sender domain ids. Which brings us to the second bit in the middle: an actual email address.


Wait a second? Does Mailgun “leak” the actual email address tied to the Mailgun account who is sending these out? It would appear so.


Why is this just flying around out there in the open and not hashed? Good question. Perhaps base64 seemed “hidden enough” when they first built their system. Or perhaps short hashes were fine for internal account stuff but across all of their user accounts collisions would occur and it didn't seem worth the trouble.


At any rate, I now had the real (not the from-spoofed) email address of the actual Mailgun accounts sending this thing. Two different X-Mailgun-Sid values, rotating. I sent the details to [email protected], and the ball is now in their court.


Garbage In, Garbage Authenticated


All of this just made me realize how the modern spamscape has shifted in 2026.


Scammers don't waste time building IP reputation on compromised or disposable boxes anymore. They don't need to. They chain together forgotten relay delegations with major email infrastructure providers, and the result is an email whose cryptographic authentication looks better than most legitimate mail.


The content is obviously spam, every heuristic screams (see the X-Spam above). But the math checks out. Two DKIM signatures, cryptographically valid, one of them perfectly aligned with a real domain. The filter is caught in a jam: trust the heuristics, or trust the signatures? The compromise is the spam folder, apparently. So the campaign keeps running, day after day, until an abuse report gets filed and processed.


Even then, that only kills the account. The forgotten relay CNAME, the delegation that signed off on the DKIM pass in the first place, doesn't go anywhere. It sits in someone's DNS, waiting for the next compromised relay account to point at it. The domain owner never even knew.


Pretty wild.