Yesterday I published an analysis claiming that 26 of 39 AI companies use SPF softfail, implying their email could be spoofed. A reader (@privacyfish) pointed out that this is misleading:


SPF ~all by itself does not always mean "the domain can be spoofed into inboxes" if the domain has DMARC enforcement and DKIM alignment working.


They're...