Cross-referencing sender domains with malicious hash lists
How to use the API to cross-reference sender domains against known malicious hash lists starts with separating sender identity from threat intelligence. A domain may pass email authentication yet still host phishing, malware or invoice fraud, so no single response should be treated as a final verdict.
Trusted Sender Score contributes domain reputation, DKIM and DMARC checks, and anti-spoofing evidence. Approved malicious-indicator feeds contribute hash matches. Your integration layer should join those signals, preserve their provenance and apply a response policy.
A dependable workflow keeps the original value, records every transformation and distinguishes “not found” from “not checked.” Timeouts, unsupported inputs, denied quotas and unavailable feeds are operational failures, not clean results.
Collect and validate sender domains
Start with raw headers rather than the visible display name. Extract candidate hosts from From, Return-Path and Reply-To, then retain authenticated organisation domains found in Received and authentication fields. Store each host separately because these addresses can belong to different providers.
Reject malformed values before calling an API, including empty labels, spaces, invalid characters and excessive lengths. Keep raw and normalised forms side by side. This makes hash matching auditable and prevents a parsing error from becoming an accidental allow decision.
Normalise domains before hashing
Normalise consistently: trim whitespace, remove a final DNS dot, convert internationalised labels to ASCII with IDNA, lowercase the host, and keep the subdomain distinct from the registrable domain. An API may score login.example.com.au, while a feed may list example.com.au; unrecorded choices can create misleading misses.
Follow each hash provider’s canonicalisation rules exactly. A SHA-256 list can still miss if it hashed URLs, mailbox addresses or another domain form, and a file-hash list cannot match a domain. For URL hashes, reconstruct only observed, authorised URL variants, never invented paths or query strings.
Query the sender trust API
Call the sender trust API after validation, using authenticated HTTPS, strict timeouts and bounded retries for transient errors. Respect rate limits, cache stable results where appropriate, and record the domain, API version, timestamp and correlation ID for later reproduction.
Interpret the returned sender trust metrics alongside DKIM, DMARC and SPF alignment, not as a replacement. Passing authentication indicates that infrastructure could send for a domain; it does not prove the displayed sender is legitimate. Keep passed, failed and unavailable states distinct.
Cross-reference malicious hash indicators
Cross-reference the normalised indicator against an approved malicious hash service or refreshed local list. Apply the source’s documented algorithm and canonicalisation before comparing full digests. Record the list, version, publication time, confidence and match status, because an unexplained “no match” has little evidential value.
Treat a match as a high-priority signal, not an infallible verdict. Stale entries, typo domains and shared hosting can cause false positives, while domain takeover can produce no hit. Establish whether the indicator is the exact host, parent domain, URL or mailbox, and document any override with an owner and expiry.
Combine evidence into a decision
Combine reputation, authentication and threat-feed evidence through a documented policy. Each result should explain the risk and action rather than collapse several facts into an unexplained score.
| Evidence combination | Interpretation | Response |
|---|---|---|
| Malicious hash match | Known malicious indicator | Block, quarantine and escalate |
| Low trust plus failed alignment | Probable spoofing or abuse | Reject or quarantine |
| Healthy authentication but low reputation | Suspicious context | Hold for review |
| No hash hit and healthy signals | No known malicious match detected | Allow only under normal policy |
Absence of a hash hit or API anomaly is not proof of safety. Retain ordinary controls such as link analysis, attachment scanning and user reporting, and record outcomes so recurring benign domains can be distinguished from novel infrastructure.
Adapt the workflow for Australia
Australian deployments need local operating context. Sydney and Melbourne are major centres for finance, professional services and online commerce, and many legitimate businesses use .com.au or .au. Preserve those suffixes during canonicalisation and test internationalised domains used by Australian organisations.
The country’s large online retail market makes invoice, delivery and account-recovery impersonation especially relevant. The Spam Act 2003 also imposes consent, identification and unsubscribe duties on commercial email; a malicious-domain match supports suppression but does not alone establish legal non-compliance.
Use current ACSC Scamwatch advisories to enrich cases involving Australian brands or government-like language. Store timestamps in UTC and display AEST (UTC+10) or AEDT (UTC+11) during daylight saving, so incidents reconcile across Australian states without ambiguity.
Monitor drift and document outcomes
Run checks at gateway time for enforcement and periodically for reporting. Cache according to the shorter lifetime of the trust result or threat-feed entry, and refresh domains still seen in recent mail so a new campaign is not hidden by an old response.
Use the platform’s domain monitoring checklist to assign ownership for metric changes, authentication failures and feed coverage. Track false positives, outages, API errors and unmatched suspicious domains by business unit, then compare patterns with known campaigns.
Review the policy whenever the API, hash algorithm, feed format or scam landscape changes. Retain source timestamps, decisions and minimal personal data so each enforcement action remains explainable and defensible.