No - npr.org is not practically spoofable.

• ✓DMARC policy=reject at 100%: Any email claiming to be from npr.org that fails authentication will be outright rejected by receiving mail servers. The 100% enforcement rate and use of relaxed alignment (adkim=r, aspf=r) means legitimate senders have room to operate, but forged mail gets no mercy.
• ✓SPF -all (hardfail): The final -all mechanism rejects any server not explicitly listed. NPR's SPF record is comprehensive—over 30 IP ranges and includes from partners like Salesforce, Outlook, and Mandrill—but any unlisted sender will fail hard. This prevents attackers from using their own mail infrastructure to impersonate npr.org.
• ✓DKIM at 5 selectors (k2, mandrill, s2, selector1, s1): Multiple DKIM selectors indicate NPR uses different signing keys for different sending channels and platforms. An attacker would need to compromise multiple key material sources to forge signatures; finding even one valid selector is a significant barrier.
• ·MTA-STS not deployed: MTA-STS enforces encrypted, authenticated connections between mail servers and protects against downgrade and MITM attacks in transit. Its absence doesn't create a spoofing vulnerability directly, but it's a belt-and-suspenders layer that NPR isn't using.

Bottom line: NPR is not spoofable; they have implemented the full toolkit correctly, with no practical gaps for attackers to exploit.