Spoofability verdict for ft.com
No - ft.com is not practically spoofable.
See the math
The Financial Times has built a textbook email-protection posture across the three signals that matter most. DMARC at p=reject with 100% enforcement and SPF hardfail are the gold standard—and together they close off the entire spoofing vector.
- DMARC p=reject at 100%: Any email claiming to be from ft.com that fails DMARC authentication is rejected outright by all receiving mail servers. This is the strongest possible policy and applied to all traffic, not a percentage sample.
- SPF -all (hardfail): SPF hardfail means only mail servers explicitly authorised via the include directives (Google, Marketo, Salesforce, HubSpot, Mandrill, and others) can send from ft.com. Everything else is rejected. No gradation—this is a clean boundary.
- DKIM at 4 active selectors: DKIM signing at multiple selector points (google, s1, mandrill, s2) across your sending infrastructure means legitimate mail is cryptographically signed and verifiable. Found after probing 22 common selectors, indicating mature operational coverage.
- MTA-STS missing: MTA-STS enforces TLS in transit and prevents downgrade attacks on the SMTP connection itself. It's not deployed, but DMARC + SPF hardfail already prevent the attacker from sending mail that will be accepted, so the practical risk is low.
What this means practically
An attacker cannot practically spoof ft.com. They could craft a phishing email with an ft.com From: header, but it will fail SPF (no matching authorised sender), fail DKIM (no valid signature from an authorised selector), and then be rejected at the receiving mail server before it ever reaches a human inbox. This applies across Gmail, Outlook, Yahoo, and enterprise mail systems that honour DMARC. There is no realistic path to delivery.
Bottom line: Financial Times has eliminated spoofing as a viable attack: p=reject + SPF hardfail + DKIM coverage is the defence that actually works, and it's deployed here at full strength.
What we measured
Enforced
DMARC policy
p=reject
DMARC at p=reject (pct=100). Spoofed mail is rejected at SMTP.
Enforced
SPF posture
-all (hardfail)
SPF ends in -all (hardfail). Receivers reject mail from IPs not in the policy.
v=spf1 include:_spf.google.com include:mktomail.com include:_spf.salesforce.com include:email.hivebrite.com include:spf.mandrillapp.com include:24982124.spf07.hubspotemail.net include:spf.alida.io -all
Enforced
DKIM presence
found at 4 selectors
DKIM key found at selectors: google, mandrill, s2, s1.
Open
MTA-STS (transport)
missing
No MTA-STS policy. Inbound mail can be intercepted via DNS / MX downgrade.
How to make it un-spoofable
- Publish an MTA-STS policy in enforce mode + a TLS-RPT reporting endpoint.