Comment by peanut-walrus

This works against domains that have DMARC configured properly. First attack works against any domain that is using O365, regardless of their DMARC settings.