Spoofability verdict for gov.uk
No - gov.uk is not practically spoofable.
See the math
GOV.UK has built one of the most defensible email security postures in the public sector. The domain combines strict DMARC enforcement with SPF hardfail and extensive DKIM coverage—a combination that makes spoofing practically impossible.
- DMARC p=reject (strict alignment): DMARC policy is set to reject, not quarantine. Alignment is strict on both DKIM and SPF (adkim=s, aspf=s), meaning emails must pass authentication checks under the exact domain—no subdomain tricks. Any misalignment is rejected outright.
- SPF -all (hardfail): SPF uses explicit hardfail (-all), meaning only servers listed in the SPF record are authorised to send mail from gov.uk. Any other source fails hard; there is no fallback or softfail escape hatch.
- DKIM at 20+ selectors: GOV.UK maintains at least 20 active DKIM selector pairs (default, s1–s2, k1–k2, fm1–fm3, sib, google, sendgrid, mandrill, protonmail, mxomail, mxvault). This breadth suggests multiple legitimate senders across government services and suppliers, all properly authenticated.
- MTA-STS missing: MTA-STS is not deployed. This signals don't affect inbound spoofing risk, only outbound mail security (preventing downgrade attacks on gov.uk's own outbound connections). DMARC + SPF + DKIM already seal the inbound spoofing door.
What this means practically
An attacker cannot realistically send email that appears to come from gov.uk and land in a recipient's inbox. SPF hardfail blocks any server not pre-authorised; DMARC reject + strict alignment block SPF or DKIM workarounds. Even if an attacker compromises a gov.uk supplier or service, they would need that supplier's private DKIM key to produce a valid signature—unlikely. Emails that fail alignment are rejected at the mail server level, not just spam-foldered.
Bottom line: GOV.UK is a textbook example of responsible email authentication and represents the gold standard most organisations should aim for.
What we measured
Enforced
DMARC policy
p=reject
DMARC at p=reject (pct=100). Spoofed mail is rejected at SMTP.
Enforced
SPF posture
-all (hardfail)
SPF ends in -all (hardfail). Receivers reject mail from IPs not in the policy.
v=spf1 -all
Enforced
DKIM presence
found at 22 selectors
DKIM key found at selectors: mandrill, protonmail, protonmail2, sib, s1, k2, mxomail, protonmail3, default, sendgrid, google, mail, pm, s2, selector1, fm1, selector2, mxvault, k1, fm2, dkim, fm3.
Open
MTA-STS (transport)
missing
No MTA-STS policy. Inbound mail can be intercepted via DNS / MX downgrade.
How to make it un-spoofable
- Publish an MTA-STS policy in enforce mode + a TLS-RPT reporting endpoint.