Low Severity

Spam: Spoofed Outlook mailer with unsubscribe and reference ID footer

Description

Flags inbound messages that spoof the Microsoft Outlook mailer header while containing an 'unsubscribe here' link followed by an alphanumeric reference ID pattern in the body text, a common tactic used to lend spam messages an air of legitimacy. Highly trusted sender domains are excluded from this rule when they pass DMARC authentication.

References

No references.

Sublime Security
Created Aug 21st, 2026 • Last updated Aug 21st, 2026
Source
type.inbound
and strings.istarts_with(headers.mailer, 'Microsoft Outlook')
and regex.icontains(body.current_thread.text,
                    'unsubscribe here[\s\S]{0,120}?reference\s?id:\s*[a-z0-9]{6,}'
)

// negate highly trusted sender domains unless they fail DMARC authentication
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Deploy and integrate a free Sublime instance in minutes.
Get Started