Spoofability verdict for lenovo.com
No - lenovo.com is not practically spoofable.
See the math
Lenovo has done the job right: a hard reject DMARC policy backed by two DKIM signing selectors and SPF configuration that will catch most naive spoofing attempts. This is what enterprise email security looks like when someone has actually run the playbook.
- DMARC p=reject (enforced): DMARC policy is set to reject, meaning any email that fails alignment will be outright rejected by compliant receivers. This is the highest enforcement level and stops the majority of practical spoofing attacks at the receiver.
- SPF ~all (softfail): SPF is configured with a softfail (~all) rather than a hard fail (-all). This means unauthenticated emails get flagged but not automatically rejected, which is permissive—but the includes (spf.lenovo.com and vendorspf.lenovo.com) show legitimate authorization lists are in place for their supply chain.
- DKIM at 2 selectors (s2, s1): Two active DKIM signing keys discovered. Multiple selectors allow key rotation and geographic/vendor segmentation without downtime. Receivers can validate the signature cryptographically; forging it is computationally infeasible.
- MTA-STS not configured: MTA-STS would enforce TLS encryption during mail transit to Lenovo's servers, but it's not present. This doesn't affect inbound spoofing (DMARC/SPF/DKIM do), but it leaves outbound mail slightly more vulnerable to interception in transit.
What this means practically
An attacker cannot realistically send mail that will be accepted as lenovo.com by any major email provider (Gmail, Outlook, Yahoo, corporate gateways) without compromising Lenovo's mail infrastructure or signing keys. The DMARC reject policy and DKIM enforcement are the enforcement teeth. SPF softfail alone would be weak, but layered under DMARC reject it's sufficient. Brand spoofing attempts using lenovo.com will be hard-rejected or land in spam folders.
Bottom line: Lenovo's email authentication is configured at enterprise standard—reject on alignment failure, cryptographic signing in place, and vendor delegation thought through. They're not spoofable in practice.
What we measured
Enforced
DMARC policy
p=reject
DMARC at p=reject (pct=100). Spoofed mail is rejected at SMTP.
Partial
SPF posture
~all (softfail)
SPF ends in ~all (softfail). Receivers may accept but mark mail; not enforced.
v=spf1 include:spf.lenovo.com include:vendorspf.lenovo.com ~all
Enforced
DKIM presence
found at 2 selectors
DKIM key found at selectors: s2, s1.
Open
MTA-STS (transport)
missing
No MTA-STS policy. Inbound mail can be intercepted via DNS / MX downgrade.
How to make it un-spoofable
- Tighten SPF from ~all (softfail) to -all (hardfail) once you have the list of senders right.
- Publish an MTA-STS policy in enforce mode + a TLS-RPT reporting endpoint.