Spoofability verdict for linkedin.com
No - linkedin.com is not practically spoofable.
See the math
LinkedIn has deployed industrial-grade email authentication: a hard reject DMARC policy combined with SPF and DKIM validation. This is the gold standard for companies with the resources to enforce it.
- DMARC policy=reject (enforced): LinkedIn requires both SPF or DKIM alignment and rejects unauthenticated mail outright. This is the strongest possible DMARC posture—no fallback, no wiggle room.
- SPF with softfail (~all): SPF covers LinkedIn's sending infrastructure (6 IP ranges plus docusign.net for transactional mail) but softfail allows unauthenticated senders through at low priority. Combined with hard-reject DMARC, this softfail becomes largely academic: Gmail, Outlook, and other major receivers respect the DMARC reject signal regardless.
- DKIM (google selector found): DKIM signature is active and discoverable, providing cryptographic proof of message origin. Attackers cannot forge this without LinkedIn's private key.
- MTA-STS missing: MTA-STS isn't deployed, so there's no machine-readable policy enforcing TLS for SMTP delivery. This is a minor gap—it doesn't weaken authentication, but it does leave a small window for downgrade attacks on the transport layer.
What this means practically
An attacker cannot realistically spoof LinkedIn mail. DMARC reject will cause receiving servers (Gmail, Outlook, corporate gateways) to block messages that fail SPF/DKIM alignment before they reach end users. Even if an attacker spoofs the From: header, authentication checks will fail and the message will be rejected or junked. The softfail in SPF doesn't matter here; DMARC's hard reject is the enforcer.
Bottom line: LinkedIn's DMARC reject policy, paired with active DKIM, makes spoofing extremely difficult; this is a mature, well-executed authentication posture.
What we measured
Enforced
DMARC policy
p=reject
DMARC at p=reject (pct=100). Spoofed mail is rejected at SMTP.
Partial
SPF posture
~all (softfail)
SPF ends in ~all (softfail). Receivers may accept but mark mail; not enforced.
v=spf1 ip4:199.101.162.0/25 ip4:108.174.3.0/24 ip4:108.174.6.0/24 ip4:108.174.0.0/24 ip6:2620:109:c00d:104::/64 ip6:2620:109:c006:104::/64 ip6:2620:109:c003:104::/64 ip6:2620:119:50c0:207::/64 ip4:199.101.161.130 mx mx:docusign.net ~all
Enforced
DKIM presence
found at 1 selector
DKIM key found at selector: google.
Open
MTA-STS (transport)
missing
No MTA-STS policy. Inbound mail can be intercepted via DNS / MX downgrade.
How to make it un-spoofable
- Tighten SPF from ~all (softfail) to -all (hardfail) once you have the list of senders right.
- Publish an MTA-STS policy in enforce mode + a TLS-RPT reporting endpoint.