Ah, not even that - https://s3.eu-west-1.amazonaws.com/ncsc-content/files/Actice%20Cyber%20Defence-The%20Second%20Year.pdf Messages were already being blocked by DMARC policy (so either SPF or DKIM checks were failing), they just picked up on the volume of DMARC reports for that subdom and investigated further