Ghost-Sender: Why DMARC Cannot Stop Spoofing When Exchange Online Is Misconfigured

Thu, 18 Jun 2026 08:00:00 +0000

In early June 2026, Swiss cybersecurity firm InfoGuard Labs disclosed a vulnerability they named Ghost-Sender: a misconfiguration in Microsoft Exchange Online that allows an attacker to deliver email impersonating any sender – internal or external – directly to a target organization’s inbox while bypassing SPF, DKIM, and DMARC authentication entirely.

Microsoft was notified on April 21, 2026. By May 29, 2026, the company’s Security Response Center had classified the issue as a known architectural limitation rather than a product vulnerability. No platform-level fix has been issued. The responsibility for remediation sits entirely with Exchange Online administrators.

Ghost-Sender on Daily DMARC News

Ghost-Sender: Why DMARC Cannot Stop Spoofing When Exchange Online Is Misconfigured