{"success":true,"data":{"id":"dkim-domain-mismatch-with-bulk-body","label":"Reputation laundering: DKIM signed by 3rd-party domain + bulk marketing body, no List-Unsubscribe","description":"Reputation laundering via compromised third-party relay: the DKIM signing domain differs from the visible From domain (email signed by a hacked site or university relay rather than the sender's own infrastructure) AND there is no List-Unsubscribe header (legitimate ESPs always add it) AND the body contains 2+ bulk/marketing patterns. This combination fingerprints spam sent through compromised-but-reputable servers to evade IP-reputation blocklists. Score: +3, stacks with dkim-alignment-mismatch +1 for a total of +4 on confirmed cases.","tier":"danger","category":"header","isThin":false}}