Aduana Digital de Defensa Argentina
Create ADDA access
← ADDA Manual

mail-shield/1.1.0 · updated Jul 9, 2026

Email, spoofing, and phishing response

How to read authentication, spoofing, and email campaigns with response criteria.

Mail in ADDA combines authentication, domain reputation, links, and operational context to reduce uncertainty before action.

Phishing response gains speed when email, DNS, Evidence, and incidents speak the same language. It is not only about marking a message as suspicious: explaining the risk, preserving traceability, and leaving clear continuity recommendations also matter.

If a domain or email campaign reappears, escalate to Intelligence, watchlists, or takedown packs so each analysis does not restart from zero.

Checklist

  • • Check the domain and authentication before deciding on a measure.
  • • Cross-check links, subject, and campaign if the case appears repeated.
  • • Connect Evidence or an incident when the finding affects operations.

Quickstart

  1. 1. Validate the domain and spoofing before communicating a campaign.
  2. 2. Assess whether the case requires an abuse report, early warning, or incident.
  3. 3. Save Evidence if the finding led to blocking or external coordination.

Operational flow

Verify domain

Read SPF, DKIM, DMARC, and signals associated with the observed domain.

Determine whether spoofing warrants reducing trust.

Relate the campaign

Cross-check links, subject, and repetition patterns with incidents or Intel.

Move beyond analyzing a single email.

Respond

Decide whether to warn, report abuse, open an incident, or prepare a response pack.

Provide an operational and explainable closure.

flowchart LR
  S1["Verify domain"]
  S2["Relate the campaign"]
  S3["Respond"]
  S1 --> S2
  S2 --> S3

Validators and checks

They run a contextual reading for this surface and return suggested steps with an operational focus.

Check email domain

Summarizes estimated authentication, risk, and next steps.

Examples

Payload for email analysis

{
  "domain": "secure-capacero.ar",
  "subject": "Actualizá tu acceso ahora",
  "links": [
    "http://secure-capacero.ar/login"
  ]
}

Links and references

APIs

  • /api/adda/v1/mail/analyze
  • /api/adda/v1/mail/check-domain
  • /api/adda/v1/reports/abuse

Docs and supporting routes

  • docs/ADDA_API.md
  • docs/ADDA_INTEL.md

Common issues

  • • Analyzing only the domain and not the links can underestimate the campaign.
  • • Responding to phishing without Evidence or an incident makes it harder to reconstruct the case history.

Suggested actions

  • • If the email leads to public or institutional measures, seal Evidence.
  • • Escalate to watchlists or a takedown pack if the pattern reappears or replicates.

Useful reason codes

DNS_SUSPICIOUS

The domain associated with the email shows risk signals.

Strengthen validation before assuming legitimacy.

UA_SUSPICIOUS

Links or agents associated with the case appear untrustworthy.

Adopt a verification or containment posture.

Score dictionary

spoofingRiskScore

Combined authentication and spoofing risk.

severity

Priority of the analyzed email or domain.

reasonCodes

Defensive reasons used to explain the finding.

Protocol notes

  • • Phishing is often multichannel: connect Mail with DNS, incidents, and Intel.

Article history

Jul 9, 2026

Added an operational article for phishing and spoofing response.