Spoofability verdict for discord.com
No - discord.com is not practically spoofable.
See the math
Discord enforces a hardened DMARC policy with corresponding SPF and DKIM alignment, making sender impersonation extremely difficult in practice.
- DMARC p=reject (fully enforced): Discord's DMARC policy mandates rejection of mail that fails authentication checks. This is the strongest policy available and applies uniformly across all recipients.
- SPF -all hardfail: SPF hardfail (-all) rejects any mail claiming to be from discord.com that comes from unlisted servers. Discord explicitly authorises Google, Zendesk, SendGrid, HubSpot, and one fixed IP address—nothing else passes.
- DKIM at 3 selectors (s1, mandrill, s2): DKIM signing at multiple selectors means Discord's outbound mail is cryptographically signed. Without the private key, forged mail fails signature verification at receiving servers.
- MTA-STS missing: MTA-STS would enforce encrypted SMTP delivery, but its absence doesn't undermine DMARC/SPF/DKIM. These signals already make spoofing impractical.
What this means practically
An attacker cannot realistically send mail that both claims to be from discord.com and reaches the inbox. SPF will reject forgeries from unauthorised servers, DKIM will fail without the private key, and DMARC will enforce rejection at any receiver that respects standards. Receivers including Gmail, Microsoft 365, and most enterprise systems will drop these attempts outright.
Bottom line: Discord's authentication posture is defensively mature: p=reject with tight SPF and multi-selector DKIM makes impersonation of this domain practically impossible.
What we measured
Enforced
DMARC policy
p=reject
DMARC at p=reject (pct=100). Spoofed mail is rejected at SMTP.
Enforced
SPF posture
-all (hardfail)
SPF ends in -all (hardfail). Receivers reject mail from IPs not in the policy.
v=spf1 include:_spf.google.com include:mail.zendesk.com include:sendgrid.net include:3885857.spf06.hubspotemail.net ip4:198.2.180.60 -all
Enforced
DKIM presence
found at 3 selectors
DKIM key found at selectors: s2, mandrill, s1.
Open
MTA-STS (transport)
missing
No MTA-STS policy. Inbound mail can be intercepted via DNS / MX downgrade.
How to make it un-spoofable
- Publish an MTA-STS policy in enforce mode + a TLS-RPT reporting endpoint.