Under the Compromised Account tab you will find the option to Verify auth header for BEC. Here are the details about that option.
As part of our BEC (Business Email Compromise) detection, we added an additional verification layer that checks the DKIM signature on inbound emails before they're scored as suspicious or legitimate. DKIM lets us cryptographically confirm that a message actually came from the domain it claims to be from and wasn't altered in transit — it's a strong signal for catching spoofed or impersonated senders.
However, DKIM isn't universal — not every organization publishes a DKIM record in their DNS. If a sending domain doesn't have DKIM configured, our check would fail by default, which could cause false positives (legitimate emails from that domain getting flagged as suspicious simply because DKIM couldn't be verified).
To handle this, we added a per-account toggle in Settings: if a client's own domain (or a partner/vendor domain they frequently receive mail from) has DKIM authentication properly enabled, they can switch this ON so our system enforces the DKIM check. If a domain doesn't support DKIM yet, leaving it OFF prevents us from unfairly penalizing that domain's emails while we fall back to our other authentication and scoring signals.
In short: the toggle exists to accommodate real-world inconsistency in DKIM adoption across domains, so we can apply strict DKIM verification where it's supported without generating false positives where it isn't.
