Spoofability verdict for citi.com
No - citi.com is not practically spoofable.
See the math
Citi has built a genuinely protective email authentication posture. This is what responsible DMARC deployment looks like at scale: hard rejection policy, enforced DKIM signing, and a real SPF estate that backs up legitimate traffic.
- DMARC policy=reject (enforced): Citi enforces DMARC with an explicit reject policy—any mail claiming to be from citi.com that fails DMARC authentication will be rejected by compliant receivers. This is the gold standard for high-value brands.
- SPF with 5 A-records + includes (partial strictness): SPF chain includes legitimate sending infrastructure across citigroup.com, lwo.locaweb.com.br, and pphosted.com. The use of a redirect mechanism and multiple A-record lookups shows deliberate infrastructure design, though SPF's neutral qualifier (vs. explicit -all) means some edge cases aren't hardened.
- DKIM at s2, s1 selectors (enforced): DKIM signatures enforce identity cryptographically—we found active keys at two common selectors. This means each legitimate email from Citi carries a digitally signed proof of origin that forgers cannot replicate.
- MTA-STS missing: MTA-STS is absent, meaning sending MTAs can't enforce encrypted delivery to Citi's mail servers. This is a known gap in email security, but doesn't weaken authentication itself—it only affects in-transit security.
What this means practically
An attacker cannot realistically send mail that appears to come from citi.com. The combination of DMARC reject, DKIM signatures, and SPF validation means that Gmail, Microsoft 365, and enterprise mail systems will reject or severely penalize forged Citi mail before it reaches a user's inbox. Even a sophisticated attacker with access to legitimate SPF infrastructure would need to also crack Citi's DKIM private keys—an entirely separate and much harder problem.
Bottom line: Citi has implemented email authentication correctly; spoofing citi.com is not a practical attack vector.
What we measured
Enforced
DMARC policy
p=reject
DMARC at p=reject (pct=100). Spoofed mail is rejected at SMTP.
Partial
SPF posture
?all (neutral)
SPF record present but has no terminal mechanism. Behaviour at receivers is unspecified.
v=spf1 a:1._spf.citigroup.com a:2._spf.citigroup.com a:mailir.citi.com include:spf-00123c01.pphosted.com include:_spf.lwo.locaweb.com.br redirect=ext1._spf.citigroup.com
Enforced
DKIM presence
found at 2 selectors
DKIM key found at selectors: s2, s1.
Open
MTA-STS (transport)
missing
No MTA-STS policy. Inbound mail can be intercepted via DNS / MX downgrade.
How to make it un-spoofable
- Publish an MTA-STS policy in enforce mode + a TLS-RPT reporting endpoint.