In a platform that ingests broker emails to screen real estate deals, the from-address isn't just metadata — it's the field that determines deal ownership. Whoever the pipeline believes an email came from effectively owns the deal that email creates. That's a normal-looking piece of infrastructure with an outsized business consequence if it's wrong.
What the review actually looked at
Rather than assume AWS SES's defaults were sufficient, the review walked through:
- SPF: whether the sending server is actually authorized for the claimed domain.
- DKIM: whether the message signature is valid and unmodified in transit.
- DMARC: how the pipeline should behave when SPF/DKIM alignment fails — reject, quarantine, or accept with a lower trust signal.
The point wasn't paranoia — it was documentation
Most of this behavior already existed by default. What didn't exist was a written, deliberate answer to "what happens when authentication fails, and why did we choose that." That gap is what actually gets exploited — not the mechanism, but nobody having decided on purpose what the mechanism should do.
Outcome
The pipeline's authentication handling didn't change dramatically, but it's not implicit anymore. There's now a documented decision behind why a failed check does what it does, which matters a lot more once "who owns this deal" depends on getting it right.