How can you identify a compromised sending domain?

Traffic anomalies: sudden volume increases, sends to unusual recipients or regions, activity at unexpected hours, and messages with unfamiliar content. Monitoring tools should alert on significant deviations.

External signals: increased complaints from recipients, blocklist notifications, bounces mentioning spam filtering, and contacts reporting suspicious messages from your domain. External feedback often reveals compromise first.

DMARC reports show unauthorized sending: sources you don't recognize passing or failing authentication for your domain. Aggregate reports reveal compromise-related sending before other signals emerge.