Harden deliverability when security headlines spike

Inbox placement takes a hit when your stack looks risky. This month’s headlines—eight critical Adobe Campaign Classic bugs, device‑code phishing, and Microsoft 365 token replay—give mailbox providers more reasons to doubt. Here’s how to shore up trust without sandbagging your next send.

Start with the loudest risk: patch what powers your sends

Adobe disclosed eight critical flaws in Campaign Classic, with one, CVE‑2026‑104351, rated 9.9—near the maximum severity—and warned that code execution, bypasses, and privilege escalation were in play. If your marketing ops touch Campaign Classic at any point in the build‑send‑track loop, patching is not optional. Adobe’s own framing is clear: unpatched instances create code‑execution paths that jeopardize data and sending identity, both of which drive deliverability risk when mailbox providers notice unusual behavior or reputational spillover.

Campaign Classic doesn’t need to be your primary sender to matter. If it shares processors, connectors, or data stores with your ESP or automation tool, a compromise can pivot into the mail path. That becomes visible fast: new sending IPs, atypical volume shapes, or bursts of authentication failures can push your domains toward blocklists and secondary filtering until telemetry looks stable again. Patching closes holes; annotating your post‑patch behavior in ops notes helps explain short‑term anomalies to internal stakeholders.

Prove your signer isn’t wobbling: a one‑minute DKIM smoke test

Mailbox providers judge consistency. A fast DKIM (DomainKeys Identified Mail) check—hash an empty body and compare—confirms your signer isn’t mangling whitespace or canonicalization. The simple test outlined in our guide on DKIM’s simplest check is reproducible and catches drift early. When you change MTAs, update libraries, or apply patches, run the test before and after. A single whitespace mishandling can invalidate signatures at scale and look, from the outside, like spoofing.

Canonicalization choice matters. If you use relaxed/simple today, confirm downstream systems that wrap or minify HTML won’t break headers or bodies post‑patch. The smoke test gives you a quick pass/fail, but you should also spot‑audit real messages across templates, including your transactional set (password resets, receipts) because mailbox providers weigh them heavily when assessing domain trust.

Tighten policy: DMARC enforcement and visible identity

DMARC (Domain‑based Message Authentication, Reporting & Conformance) needs to sit at enforcement for your primary domains—p=quarantine or p=reject—before you chase inbox cosmetics like BIMI. As laid out in our explainer on BIMI logos start with DMARC enforcement, enforcement is the gate; the logo is a downstream benefit. If you’re stuck at monitoring, schedule a staged move: subdomain first, then organizational domain, with reporting reviewed after each step.

Service notifications also force your hand. Stripe now treats DMARC as table stakes for custom sender domains and falls back to stripe.com when DNS slips, changing branding and alignment. Their stance, covered in Stripe makes DMARC table stakes, mirrors mailbox expectations: authenticated, aligned mail routes get preference when traffic spikes.

Expect better phish and worse consequences: device codes and token replay

ANY.RUN highlights “Skyw4lker” leaning on device code phishing to sneak into U.S. corporate accounts by piggybacking trusted cloud sign‑ins. Because device codes piggyback normal flows, help desks and users often don’t flag them as odd. Layer that with Huntress’s report of an adversary‑in‑the‑middle token‑replay spree from mid‑July to late September that reached 79 Microsoft 365 tenants, and you’ve got a reliable delivery‑adjacent risk: attackers sending from inside your tenant look legitimate enough to tank reputation if they hit many recipients.

Two controls reduce the blast radius. First, set conditional access so device‑code and interactive logins trigger re‑verification on privilege changes or help‑desk PIN resets, a response to social engineering like calls that, as we noted in AI is sweet‑talking help desks, are getting slicker. Second, cap token lifetimes and revoke sessions on role edits, cutting token replay windows the way Huntress saw exploited in Microsoft 365 tenants.

Align security signals with your response tools

Proofpoint’s detections can now surface inside Microsoft’s ICES, which means phishing, BEC, and ransomware signals appear where your responders already live. This reduces console‑hopping lag—a concrete gain when you’re triaging device‑code abuse or freshly exploited marketing‑stack credentials. If those alerts cite your mail domains or infrastructure, pause questionable campaigns for 24–48 hours while you re‑assert DKIM validity and DMARC alignment, rather than letting questionable messages continue to accrue negative engagement.

If you run mixed stacks, document who owns enrichment and takedown. A single unresolved alert about your sending domain inside Defender can spill into domain‑based filters across providers, even when content is harmless. Treat the first hour after a high‑confidence alert as a reputation window: fix the cause, publish a brief internal note, and, if necessary, rotate keys connected to your automation flows.

Check your supply chain and TLS identity assumptions

Security events you don’t control can still dent delivery. Our explainer on when supply chains wobble covers hijacked packages and cracked CAs that ripple into mail. More recently, eight intermediate keys tied to eMudhra were recoverable; browsers moved fast, but email stacks need updates too, as we noted in Email needs patches too. If your MTAs or relays still trust stale chains, TLS handshakes can degrade, nudging some receivers toward soft fails.

There’s also a 2027 clock. Chrome’s root program will stop issuing client‑auth‑capable certificates, and M3AAWG says SMTP needs a shared approach for sender identity over TLS. If you rely on client‑auth today, start tracking that dependency and test alternatives during Q1 pilots so you’re not compressing risk late in the cycle. Category resources under /category/security collect these shifts in one place.

A realistic weekly checklist that won’t wreck your cadence

• Patching: inventory Campaign Classic touchpoints Monday; apply Adobe’s eight fixes in a maintenance window; retest end‑to‑end sends within 24 hours; annotate dashboards with timestamps.
• Authentication: run the empty‑body DKIM test before/after infra changes; review DMARC reports mid‑week; move one domain or subdomain to enforcement each sprint.
• Access: require re‑auth on help‑desk changes; cap session/token lifetimes; monitor device‑code sign‑ins; revoke tokens on role edits and after suspected AitM.
• Signals: verify Proofpoint‑to‑Defender integration; set a 48‑hour hold policy for questionable campaigns; rotate automation API keys quarterly.
• Supply chain: update trust stores after CA incidents; test TLS handshakes from each sending IP; log reject/soft‑fail deltas after updates.

How to explain the changes to non‑deliverability stakeholders

Three bullets work. First, Adobe shipped eight critical Campaign Classic fixes, including a 9.9 CVE, and you applied them to prevent code execution in your marketing stack. Second, attackers used device codes and token replay to enter 79 Microsoft 365 tenants without MFA prompts, so you shortened token lifetimes and added re‑verification. Third, your DKIM and DMARC checks prove alignment and signature integrity, protecting brand and billing flows that now depend on enforcement.

What to do if your reputation dips after doing the right thing

If opens or inbox rates soften within 72 hours of patching or key rotations, correlate with logs rather than rolling back. Re‑send a small control cohort from a proven IP with identical content to separate content‑from‑infrastructure effects. Confirm DKIM with the empty‑body hash test; ensure DMARC alignment didn’t slip. If signals in Defender show Proofpoint‑flagged items tied to your domain, pause non‑transactional mail for one send cycle, then ramp with monitoring.