Chapter 01
How mail is built
- ✓MX, SMTP, envelope, header, body
- ✓SPF mechanisms, DKIM selectors, DMARC alignment and policy
- ✓How to read a header from the bottom
← All guides
✉️ Blue team · 17 pages
Read the message the way the gateway did, then take the session back.
Envelope versus the From the user saw, SPF and DMARC in plain language, device code and payment fraud, and the revoke order that kicks the attacker out.
“Authentication tells you who was allowed to use a domain. It does not tell you the person is good. The session tells you whether they are already inside.”— Rishav Bhardwaj
Why you need this — honestly
- SPF pass is being treated as a clean bill, and it is not.
- You need device code, adversary-in-the-middle, and a bank-change email as different cases with different first moves.
- A password reset is leaving them in the mailbox because the refresh token is still alive.
What's inside
Written in plain language. No jargon for the sake of jargon. Every section ends with something you can do, not just read.
Chapter 02
The attacks
- ✓Harvest, adversary-in-the-middle, device code, OAuth consent
- ✓Business email compromise and thread hijack
- ✓QR codes and why a clean attachment is not a clean case
Chapter 03
Containment
- ✓Revoke refresh tokens, revoke sessions, reset the password
- ✓Rules, forwarding, and app grants
- ✓When the laptop matters, and when it does not
Perfect if you are…
SOC analystsMail administratorsAnyone who triages a reported phish
Related guides
Pair Email Security with these — each is a separate instant-download PDF by Rishav Bhardwaj.
Deep Phishing Analysis
Headers, kits, device-code abuse & AiTM — like a real SOC lead teaches it.
View guide →
Malware Analysis Bible
Static, dynamic, behavioral — with a lab mindset that sticks.
View guide →
SIEM Detection Rules & Use Cases
High-signal detections, logic, and tuning notes — not noise.
View guide →
Cloud Security, A to Z
IaaS to GRC — identity, crypto, network, DevSecOps, and incidents across AWS, Azure, and GCP.
View guide →
How to read a message and take a mailbox back
Envelope, header, and body are different. SPF pass is not a clean bill. This guide walks the fields, the attacks, and the containment order.
- How SMTP, MX, SPF, DKIM, and DMARC actually decide
- A header method you can use on the next reported phish
- Harvest, adversary-in-the-middle, device code, consent, and payment fraud
- Revoke refresh tokens, revoke sessions, then reset the password
Common questions
- How is this different from the short phishing guide?
- The short guide is the modern attack briefing. This is the full path: how mail is built, every authentication field, and what you do after the click, including payment fraud with no attachment.
Instant PDF download
Email Security
$12.02
17 pages · 2–3 hours · one-time purchase
International checkout
After you continue to payment, on the Cashfree page please select PayPal (scroll to International Walletif you don't see it).
Prices on this site are in USD. Cashfree may show the equivalent in ₹ — that is normal; PayPal lets you pay from outside India.
✓ 7-day money-back guarantee · instant PDF delivery · no subscription
847 professionals already downloaded this
Want every guide? Complete bundle for $43.35 →
Want live guidance? Book a 1-on-1 with me →
About me
Rishav Bhardwaj — cybersecurity practitioner & author of Cyber Rishav
I've trained 200+ analysts, built blue-team programs inside real enterprises, and still sit in the work — SOC triage, cloud risk, GRC, and IR. These guides are the same structured thinking I use in programs and 1-on-1s, written so you can act this week, not someday.
CISSPCCSKSecurity+CEHISO 27001
Rishav Bhardwaj
Cybersecurity practitioner · Blue team
200+
Analysts coached
10K+
Enterprise seats in IR programs
12
Deep-dive guides
Every guide in this library is something I use when coaching analysts and building programs — not content farm filler. If it does not help you act this week, it does not ship.