Threat hunting playbooks with sender domain trust scores

Spoofed and lookalike sender domains can make fraudulent emails resemble routine Australian business communications. A useful threat hunt connects domain reputation, email authentication, and sending history before deciding whether a message deserves containment.

A playbook turns that investigation into repeatable steps: define trust signals, collect evidence, apply thresholds, triage alerts, contain threats, and record what changed. This guide explains how to create a threat hunting playbook using sender domain trust scores without treating a score as proof of malicious activity.

Define the hunt and baseline

Start by listing corporate domains, approved sending subdomains, frequent partners, and common impersonation targets. Assign each asset an owner and business criticality, then identify the systems that can provide email headers, authentication results, user reports, and historical sending patterns.

Evidence	Lower concern	Elevated concern	Playbook action
Domain reputation	Stable, positive history	New, poor or inconsistent history	Correlate with message activity
SPF, DKIM and DMARC	Aligned and expected	Missing, failing or misaligned	Inspect headers and sending paths
Domain similarity	Exact approved domain	Character swap or unexpected suffix	Check registration context
Sending pattern	Known subdomain and volume	New host or unusual traffic	Pause delivery and investigate

Use these categories to establish team-specific thresholds rather than assuming a universally safe score. A trusted domain can host a compromised mailbox, while an unfamiliar domain may belong to a legitimate organisation introducing a new sending service.

Build a trust-data collection

Create a repeatable evidence record for every investigated domain. Capture the trust score, timestamp, SPF, DKIM and DMARC results, reputation history, observed sending use, and analyst conclusion. Trusted Sender Score supports bulk domain checks, while its API can pass verification results into a SIEM, SOAR workflow, or ticketing system without manual copying.

Include owned domains, frequent partners, and approved sending subdomains as baselines. A practical control is to configure similar-name domain alerts so a newly registered lookalike reaches the queue before a campaign reaches staff.

Set evidence-based triggers

Define triggers at three levels: investigate, restrict, and block. An investigation might begin when a score changes materially, authentication results shift, or a domain sends unexpectedly. Restriction can apply to repeated authentication failures or unusual sending volume, while blocking should require stronger evidence such as confirmed phishing infrastructure or direct mailbox compromise.

Australian market context matters because organisations commonly operate under .com.au or .au addresses, alongside international domains and campaign senders. Treat the Australian suffix as context rather than automatic trust. A new .com.au domain impersonating a known brand may present the same phishing risk as an overseas lookalike, particularly when its authentication is weak or absent.

Run the triage workflow

Each alert should enter a documented triage path. Verify the visible sender against the envelope sender, examine authentication results, inspect the destination and reply-to addresses, and check whether the sending domain matches known infrastructure. Review recipient activity, reported messages, and related indicators of compromise before assigning severity.

For teams in Sydney, Melbourne and Brisbane, Australian workplace culture generally favours concise, documented decisions. Set escalation deadlines that account for AEST and AEDT differences, especially during daylight-saving transitions. Keep handover notes brief, but retain the evidence needed to reproduce the decision and prevent duplicate investigation.

Automate recurring hunts

Automation should collect and compare evidence, not replace analytical judgement. Schedule API queries for changes in domain reputation, authentication configuration, and newly observed subdomains. Run bulk checks against approved domains, known lookalikes, and domains extracted from suspicious email headers, then create alerts only when the resulting signals cross defined thresholds.

Schedule regular sending-subdomain reviews alongside certificate, DNS, and mail-flow configuration checks. A subdomain that begins sending unexpectedly may expose an abandoned asset, compromised server, or unauthorised marketing platform even when the parent domain remains trusted.

Execute containment and recovery

Apply proportionate containment after triage. Quarantine matching messages, block confirmed malicious infrastructure, pause affected sending services, and add temporary indicators to mail controls. If investigation indicates account compromise rather than simple spoofing, escalate to the identity team for password resets, multi-factor authentication checks, token revocation, and review of suspicious mailbox rules.

Recovery should address both infrastructure and communication. Remove unauthorised DNS records, restore legitimate sending configurations, validate DKIM and DMARC alignment, and identify every recipient who interacted with the threat. The Australian Cyber Security Centre’s Scamswatch guidance can inform recipient warnings about phishing, payment redirection, and credential theft during that process.

Measure and improve the playbook

Track the number of alerts investigated, average triage time, confirmed malicious domains, false-positive rate, containment time, and recurring threat sources. Record whether each hunt began from a score alert, user report, authentication failure, or external intelligence. These measures reveal which controls generate useful evidence and which workflows create unnecessary work.

Align the playbook with the Australian Signals Directorate’s Essential Eight where appropriate, particularly identity management, multifactor authentication, application control, and secure configuration. Feed confirmed outcomes back into detection rules, ownership records, and escalation contacts. A threat hunting playbook then becomes a living operational system that converts sender domain evidence into faster, more consistent security decisions.