A colleague (A) forwarded me an email (with headers) which appears to be from another colleague (B), but which is clearly a phishing email (and which B has not sent). B had received a similar email from another colleague (C), i.e. the same content.We use Google Apps for our company email, and I have the following records set in the DNS:google._domainkeysmtp._domainkeysmtpapi._domainkeyI believe these provide the sender authentication that we need to ensure people cannot spoof our email addresses. We all have 2FA enabled on our accounts, which should make it really hard for the account to be compromised.Looking at the headers, it appears that the authentication checks have passed on the email. The relevant headers are below:ARC-Seal: i=1; a=rsa-sha256; t=1502708078; cv=none;        d=google.com; s=arc-20160816;        b=1Kb/c3UhqC6njCK1ULGSDxbKueC+bsOioW/0W1ZhtKUndgDaF1SB7v4WbV0Z5z8thJ         F+lL+FMVg3n0dj3/s5HEquVlskIcUuM776dg2ujg9VULUO25B+wuDtEgZTIxt7TGiqRq         MCrWfPQD9ZtcmWFt/S63PTT18BCZbLfUYMguRW6tSUogSxy1HRbC6qCrjnkPM1q1D4q3         VgyW8u3ir7aQEVCGkgytZcUtXWvztQ9nsA6zVCGnfGLFrVd/teMtdzZVBzOelt2+BD1e         r03Nt/s5IMMTlLeS20i4FC46iCObCzb+Nj0aWZ+4DNP7am85qRvFzqtmkQZiG7L/AmcR         89SA==ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;        h=mime-version:subject:message-id:to:from:date         :arc-authentication-results;        bh=RgXeFm41ZrdgBjkZUSNsnDQtXdlALc/pzcrFG0ba24Q=;        b=sN6W5IQrFtRzcUSifN1kGoK/QLR/oMJRXNEF1DS/vwzN9BufXF+3bpRbh/yK3GUMJB         9tuOV5pUVPN0PHGW2+zVi+bcw5iiD3uWiSLbUT7Oo9km8LREB9kXJY9ppmgjRzYAZooF         hp66aG2RZMEOz1korTsTkWUVep/flzr2jkdP66PrklxdyHIAYMxN/vMr37NgDf805Ba8         739d0OThoFvr0/IamXu0W+vm/8vpxQi2fm/iSH8Uegs9zcwQGq9np3n+3/aZNWpfJezg         Dr/ZwT74gI4ZR7567B3h2vVC5r3EZWNxtsu5Fq7+IAQeRMgktFyomrjH/kgPniNcj23I         wpxA==ARC-Authentication-Results: i=1; mx.google.com;       spf=pass (google.com: domain of postmaster@smtprelay08.ispgateway.de designates 134.119.228.109 as permitted sender) smtp.helo=smtprelay08.ispgateway.deReturn-Path: <>Received: from smtprelay08.ispgateway.de (smtprelay08.ispgateway.de. [134.119.228.109])        by mx.google.com with ESMTPS id j62si3689177wmg.143.2017.08.14.03.54.37        for <A@ourcompany.tld>        (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);        Mon, 14 Aug 2017 03:54:38 -0700 (PDT)Received-SPF: pass (google.com: domain of postmaster@smtprelay08.ispgateway.de designates 134.119.228.109 as permitted sender) client-ip=134.119.228.109;Authentication-Results: mx.google.com;       spf=pass (google.com: domain of postmaster@smtprelay08.ispgateway.de designates 134.119.228.109 as permitted sender) smtp.helo=smtprelay08.ispgateway.deReceived: from [195.81.33.253] (helo=10.0.0.43) by smtprelay08.ispgateway.de with esmtpsa (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.89) id 1dhD13-0006vU-Jf for A@ourcompany.tld; Mon, 14 Aug 2017 12:54:37 +0200My conclusion would be that the account has been compromised, but I don't know enough about how this works to be able to tell what the real possibilities are in this situation. Since it looks like the sender went via our outbound servers, my only thought is that C's account has been used to spoof the emails from B, but I doubt Google Apps allows this.Any pointers for how to analyse this would be most welcome.
How to work out if an email account has been compromised from the headers
email;g suite;phishing