Spoofability verdict for dhs.gov
No - dhs.gov is not practically spoofable.
See the math
DHS has implemented a textbook DMARC reject policy with enforcement across both SPF and DKIM, making it one of the few government domains that has closed the spoof gap entirely. This is how government email security should work.
- DMARC p=reject at 100%: Any email claiming to be from dhs.gov that fails DMARC authentication is rejected outright by receiving mail servers. DHS has set pct=100, meaning every message is evaluated against this strict standard. This is the gold standard for email authentication.
- SPF -all (hardfail): SPF is configured with a strict hardfail mechanism (-all), meaning only servers explicitly listed (including DHS IPs and Outlook/protection domains) can send valid mail. Any unlisted source will fail SPF checks immediately.
- DKIM single selector found: DHS maintains DKIM signing on selector1. A single, actively monitored selector is simpler to manage and audit than sprawling selector infrastructure, and it's cryptographically binding each message to DHS's keys.
- MTA-STS not published: MTA-STS enforces encrypted SMTP transit (TLS) between mail servers. DHS doesn't publish this policy, but the DMARC and SPF enforcement already prevents most spoofing before that becomes relevant. Not critical given the strong authentication posture upstream.
What this means practically
An attacker cannot send mail that successfully passes DHS authentication checks. SPF rejects any IP not on the whitelist. DKIM signing cannot be forged without DHS's private keys. DMARC rejects the entire message if authentication fails—there is no fallback, no gray area. Email clients and servers will refuse spoofed DHS mail at the authentication stage, before it reaches a user's inbox.
Bottom line: DHS.gov is effectively unspoofable—enforced DMARC reject with strict SPF and DKIM forms a complete authentication barrier that leaves no room for an attacker to impersonate the domain.
What we measured
Enforced
DMARC policy
p=reject
DMARC at p=reject (pct=100). Spoofed mail is rejected at SMTP.
Enforced
SPF posture
-all (hardfail)
SPF ends in -all (hardfail). Receivers reject mail from IPs not in the policy.
v=spf1 ip4:216.128.251.155 ip4:128.129.88.18 a:mail.tripwire-dhs.us include:spf.dhs.gov include:spf.protection.outlook.com include:spf-00376703.gpphosted.com -all
Enforced
DKIM presence
found at 1 selector
DKIM key found at selector: selector1.
Open
MTA-STS (transport)
missing
No MTA-STS policy. Inbound mail can be intercepted via DNS / MX downgrade.
How to make it un-spoofable
- Publish an MTA-STS policy in enforce mode + a TLS-RPT reporting endpoint.