wiredepth
Run a check

Spoofability verdict for reddit.com

No - reddit.com is not practically spoofable.

See the math

Reddit has set a high bar for email authentication, implementing strict DMARC reject policy backed by SPF and DKIM. This is the gold standard for large platforms that handle user identity and communications at scale.

  • DMARC policy=reject (enforced): Any email claiming to be from reddit.com that fails DMARC authentication will be rejected outright by receivers. This is the strongest DMARC posture and eliminates the majority of spoofing attack surface.
  • SPF with ~all (softfail): SPF includes Amazon SES, Google, HubSpot, Salesforce, NetSuite and multiple IP ranges—reasonable for a large organisation with many sending services. The softfail (~all) qualifier means SPF doesn't hard-reject unauthorised senders, but DMARC reject policy compensates for this.
  • DKIM at 2 selectors (google, k1): DKIM signatures verified on at least two selector rotation keys, adding cryptographic proof of authenticity. Attackers cannot forge valid DKIM signatures without the private key.
  • MTA-STS mode=none (open): MTA-STS prevents man-in-the-middle attacks on the SMTP connection itself. Reddit's lack of MTA-STS deployment means an attacker *could* intercept and redirect SMTP traffic, though they'd still need valid DMARC signatures to succeed.

What this means practically

An attacker cannot practically spoof reddit.com email because DMARC reject policy is enforced. Even if an attacker sends an email with a forged reddit.com address, Gmail, Outlook, Yahoo and other major receivers will reject it before it reaches a user's inbox. The softfail SPF and lack of MTA-STS are minor gaps that don't change this outcome—DMARC reject is the stronger control and it's in place.

Bottom line: Reddit's strong DMARC reject posture, combined with DKIM signatures, makes spoofing reddit.com addresses impractical; the missing MTA-STS is a minor hardening gap that doesn't materially weaken the verdict.

What we measured

Enforced

DMARC policy

p=reject

inspect →

DMARC at p=reject (pct=100). Spoofed mail is rejected at SMTP.

Partial

SPF posture

~all (softfail)

inspect →

SPF ends in ~all (softfail). Receivers may accept but mark mail; not enforced.

v=spf1 include:amazonses.com include:_spf.google.com include:19922862.spf01.hubspotemail.net include:reddit.deliver.highspot.com exists:%{i}._spf.mta.salesforce.com ip4:103.151.192.0/23 ip4:185.12.80.0/22 ip4:188.172.128.0/20 ip4:192.161.144.0/20 ip4:216.198.0.0/18 include:sent-via.netsuite.com ip4:52.50.24.208 ip4:35.174.145.124 ~all

Enforced

DKIM presence

found at 2 selectors

inspect →

DKIM key found at selectors: google, k1.

Open

MTA-STS (transport)

mode=none

inspect →

MTA-STS in mode=none (effectively disabled).

How to make it un-spoofable

  1. Tighten SPF from ~all (softfail) to -all (hardfail) once you have the list of senders right.
  2. Publish an MTA-STS policy in enforce mode + a TLS-RPT reporting endpoint.

Check another domain