Maybe - auth0.com is partially protected.

• ✓SPF -all (hardfail): SPF is configured with a strict -all (reject) policy, meaning only explicitly authorised senders (Mandrill, Amazon SES, Intacct, Marketo, Salesforce, and dozens of IP blocks) can send mail from auth0.com. This prevents basic IP spoofing by unauthenticated servers.
• ✓DKIM (4 selectors: google, s2, mandrill, s1): DKIM signatures are present across multiple selectors, allowing receivers to cryptographically verify that messages genuinely came from Auth0's infrastructure. This catches tampering and is enforced across the domain.
• ·DMARC policy=quarantine at 100%: DMARC quarantine (rather than reject) is less strict than it could be, but Auth0 applies it to 100% of traffic. However, adkim and aspf are unset, meaning the alignment requirements are not strict—messages can pass even if SPF or DKIM alignment is loose.
• ✗MTA-STS mode=none: MTA-STS enforces secure TLS connections between mail servers. Setting it to 'none' means Auth0 is not enforcing encrypted, authenticated connections—leaving the transport layer vulnerable to downgrade attacks or interception.

Bottom line: Auth0's sender authentication is solid for basic spoofing, but the lack of MTA-STS enforcement and loose DMARC alignment rules leave room for a sophisticated attacker to slip through if they can compromise or mimic one of the many authorised senders.