Yesterday I published an analysis claiming that 26 of 39 AI companies use SPF softfail, implying their email could be spoofed. A reader (@privacyfish) pointed out that this is misleading: SPF ~all by itself does not always mean "the…

Sichere Programmierung dev.to 21.05.2026, 09:37 Uhr 4 Min. Lesezeit Cloud & IT-Enterprise

↗ Quelle (dev.to)

Reagiere als Erste:r — dein Feedback zählt!

Yesterday I published an analysis claiming that 26 of 39 AI companies use SPF softfail, implying their email could be spoofed. A reader (@privacyfish) pointed out that this is misleading:

SPF ~all by itself does not always mean "the domain can be spoofed into inboxes" if the domain has DMARC enforcement and DKIM alignment working.

They're right. SPF is only one layer. The actual spoofability of a domain depends on how SPF, DMARC, and DKIM work together — and DMARC only needs one of SPF or DKIM to align for the message to pass. So I re-ran the analysis with a combined scoring model.

How email authentication actually works

Layer	What it does	On its own
SPF	Lists authorized sending IPs	Softfail (`~all`) = "flag but deliver"
DMARC	Tells receivers what to do on authentication failure	`p=reject` = hard enforcement
DKIM	Cryptographic signature proving the email is authentic	Verifies message integrity

The critical point I missed: DMARC passes if either SPF or DKIM aligns with the From domain. A domain with SPF softfail + DMARC reject + DKIM = well-protected, because even if SPF softfails, aligned DKIM makes the DMARC check pass. And if both fail, DMARC reject tells the receiver to drop the message.

Checking SPF alone — which is what my original analysis did — misses the full picture.

Corrected results: 30 protected, 3 partial, 6 with gaps

Out of 39 AI/tech companies rescanned with all three layers:

Well-protected (30 companies)

These have DMARC enforcement (reject or quarantine) plus at least one aligned authentication mechanism:

Company	SPF	DMARC	DKIM
Anthropic	softfail	reject	google
OpenAI	hardfail	reject	google
Apple	softfail	quarantine	selector1
Microsoft	hardfail	reject	selector2
Cloudflare	hardfail	reject	k1
Stripe	softfail	reject	google
DeepSeek	hardfail	quarantine	default

(+ 23 others including Cohere, Mistral, Midjourney, Perplexity, Databricks, Snowflake, Cursor, Vercel, Replit)

Anthropic — the company I highlighted yesterday as vulnerable — is actually textbook correct. Softfail SPF + reject DMARC + DKIM alignment = spoofed emails get rejected.

Partially visible (3 companies)

Company	SPF	DMARC	DKIM found?	Note
Google	softfail	reject	not on standard selectors	Almost certainly uses custom DKIM selectors — they invented the protocol
Meta	redirect	reject	not on standard selectors	Uses Proofpoint; custom selectors likely
Notion	softfail	quarantine	not on standard selectors	DMARC enforcement active via SPF alignment

Important caveat: DKIM selectors are arbitrary strings chosen by the domain owner. My scanner checks 9 common selectors (google, selector1, selector2, default, k1, s1, s2, dkim, mail). Google and Meta almost certainly sign with DKIM using selectors I didn't check. These companies have strong DMARC enforcement and are not practically at risk.

Authentication gaps (6 companies)

These have no DMARC enforcement — their DNS policies don't instruct receivers to reject authentication failures:

Company	SPF	DMARC	DKIM	Gap
Nvidia	softfail	missing	yes	No DMARC policy at all despite having DKIM
xAI	softfail	`p=none`	no	Monitoring-only DMARC, no DKIM, Chinese email infra
Stability AI	softfail	`p=none`	yes	Has DKIM but DMARC won't enforce on failure
Hugging Face	softfail	`p=none`	yes	Same — DKIM present but DMARC is monitoring-only
Inflection AI	softfail	missing	yes	No DMARC at all
Qdrant	softfail	`p=none`	no	No enforcement on any layer

p=none means the domain owner is collecting DMARC failure reports but not asking receivers to act on failures. It's a standard first step when deploying DMARC — you monitor before enforcing — but some companies stay in monitoring mode indefinitely.

This doesn't mean these companies' email is actively being spoofed. It means their DNS configuration doesn't instruct receiving mail servers to reject spoofed messages. Whether spoofing succeeds in practice depends on the receiving server's own policies.

Nvidia is the most notable gap. A $3 trillion company with DKIM set up but zero DMARC policy — they started the process but didn't finish it.

What changed from yesterday?

Metric	SPF-only analysis	Combined analysis
Companies with gaps	26 (67%)	6 (15%)
False alarms	—	20 companies mislabeled as risky
Layers checked	SPF only	SPF + DMARC + DKIM

The original analysis was technically accurate — 26 companies do use SPF softfail — but practically misleading, because most are protected by DMARC enforcement.

Check any domain yourself

I updated the interactive checker to show a combined spoofability risk score that weighs all three layers. Enter any domain and get SPF policy + DMARC enforcement + DKIM presence + an overall assessment.

Data pulled live from public DNS records via DomainIntel. All claims independently verifiable with dig.

Correction prompted by @privacyfish's comment on the original article. Data collected May 21, 2026.

CTI Threat Relationship Graph4 Knoten / 3 Relationen

CVE / Incident Software MITRE ATT&CK CWE Weakness IoC

IR-PLAYBOOK-RCEHIGH

Schritte anzeigen

SOC Incident Playbook: Remote Code Execution (RCE) Defense

WAF MitigationSofort

Virtuelles Patchen am Reverse Proxy / WAF für gefährdete URL-Pfade und Payloads aktivieren.

SecRule REQUEST_URI "@rx ..." "id:1001,phase:1,deny,status:403"

Web Shell ScanSofort

Web-Root auf neu angelegte Scripts, anomal modifizierte Dateien und Persistence scannen.

find /var/www -type f -name "*.php" -mmin -120

Outbound FilteringSofort

Ausgehenden Datenverkehr (Reverse Shells zu unbekannten IPs/Ports) blockieren.

ss -tunp | grep -E ":(4444|1337|8080|9001)"

Vendor Patching

Hersteller-Update in Staging validieren und schnellstmöglich in Produktion ausrollen.

apt update && apt --only-upgrade install <pkg>

1-Click Detection Engineering: Multi-Dialect SIEM Rules5 Formate

Regeln anzeigen

Syntax validiert (0 Fehler)

title: Detect Exploitation - I corrected my AI email security analysis — 6 companies have real gaps
id: 1c453418-48d0-4e5b-acef-575e58681f6a
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-24
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access

Syntax validiert (0 Fehler)

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-24"
        description = "YARA Signature for "
    strings:
        $str = "I corrected my AI email securi" ascii wide
    condition:
        any of them
}

Syntax validiert (0 Fehler)

index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("I corrected my AI email security analysi")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

Syntax validiert (0 Fehler)

message: "*I corrected my AI email security analysi*"

Syntax validiert (0 Fehler)

CommonSecurityLog
| where Message has "I corrected my AI email security analysi"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

🎯

MITRE ATT&CK Matrix Navigator 14 Taktiken

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

💡 Tipp: Klicken Sie auf eine TTP, um Gegenmaßnahmen und SIEM-Erkennungsregeln anzuzeigen.Enterprise Matrix v14.1

🚀 Auf tsecurity.de entdecken

◀ VORHERIGER BEITRAG 1 Min

Forward launches Predict to test network changes before deployment

IT Security Nachrichten

NÄCHSTER BEITRAG 3 Min

Leveling up from Class 10 ICSE to Polytechnic! Here is why I think even beginners need to look at code through a security lens. 👁️💻

Sichere ProgrammierungWeiterlesen ▶

Blättern: Pfeiltasten [ ← ] [ → ] · Tasten j / k · mobil: Wischen

Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich I corrected my AI email security analysi.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen

1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.

🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC

Schnell-Prompts für Analysten

⚠️ DEFANGED SANDBOX VIEW (tsecurity.de): Alle Netzwerkindikatoren und URLs wurden neutralisiert (2 Indikatoren entschärft). Nur zur defensiven Analyse!

Format: python

#!/usr/bin/env python3
# Exploit Title: PoC for Target
import socket, sys
target = '192[.]168[.]1[.]10'
url = 'hxxp://target[.]local/vuln'
s = socket.socket()
s.connect((target, 80))
s.send(b'GET / HTTP/1.1\r\nHost: target.local\r\n\r\n')