Who is really signing this?

Medium · 25 points

SPF records for eight domains that send mail, with each one's DMARC policy underneath it.

Seven of these domains would cause a receiving server to do something about a message that failed the check — reject it, quarantine it, or at least look harder. One of them tells the receiver, in as many words, that the domain has no opinion about mail sent from anywhere else. Mail forged from that domain passes.

There is no tool on this page. SPF is a sentence, not a table, and a tool that pulled the last word out of each record would be answering the question rather than letting you ask it. Read the eight records.

Submit the mechanism that makes the permissive one permissive — the token itself, not the domain: skrd{...}.

Artefact

; a survey of eight domains that send mail, taken from public DNS

alpha.example.        IN TXT "v=spf1 a mx include:_spf.provider.example -all"
_dmarc.alpha.example. IN TXT "v=DMARC1; p=reject; rua=mailto:dmarc@alpha.example"

bravo.example.        IN TXT "v=spf1 ip4:198.51.100.0/24 ~all"
_dmarc.bravo.example. IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@bravo.example"

charlie.example.        IN TXT "v=spf1 include:_spf.provider.example -all"
_dmarc.charlie.example. IN TXT "v=DMARC1; p=reject"

delta.example.        IN TXT "v=spf1 a mx include:_spf.provider.example ?all"
_dmarc.delta.example. IN TXT "v=DMARC1; p=none; rua=mailto:dmarc@delta.example"

echo.example.        IN TXT "v=spf1 mx -all"
_dmarc.echo.example. IN TXT "v=DMARC1; p=quarantine"

foxtrot.example.        IN TXT "v=spf1 ip4:203.0.113.0/24 ip6:2001:db8::/32 -all"
_dmarc.foxtrot.example. IN TXT "v=DMARC1; p=reject; pct=100"

golf.example.        IN TXT "v=spf1 include:_spf.provider.example ~all"
_dmarc.golf.example. IN TXT "v=DMARC1; p=none; rua=mailto:dmarc@golf.example"

hotel.example.        IN TXT "v=spf1 a -all"
_dmarc.hotel.example. IN TXT "v=DMARC1; p=reject"

Hint

Every SPF record ends with a qualifier saying what to do with everything the earlier mechanisms did not match. There are four: `+` means pass, `-` means fail, `~` means soft fail, and one of them means the domain declines to say. Seven records here use one of the first three.