Spoofability verdict for trendmicro.com
No - trendmicro.com is not practically spoofable.
See the math
Trend Micro is a security vendor that practices what it preaches: this is a textbook example of email authentication done right, with DMARC reject policy, SPF hardfail, and multiple active DKIM signers all working in concert.
- DMARC policy=reject at 100%: DMARC rejects all email claiming to be from trendmicro.com unless it passes DKIM or SPF alignment. The 100% enforcement (pct=100) and strict alignment (adkim=r, aspf=r) means there's no wiggle room for attackers.
- SPF -all (hardfail): SPF hardfail (-all) means any IP not explicitly listed in the SPF record will fail. The record includes mx, three dedicated Trend Micro IP blocks, plus legitimate third-party senders (Mandrill, Docebo, etc.), but rejects everything else.
- DKIM at 6 active selectors: Six different DKIM selectors found (selector1, mandrill, s1, s2, k2, selector2) indicates multiple signing sources across different platforms and regions. An attacker would need to compromise a private key to forge a valid signature.
- MTA-STS missing: MTA-STS enforces TLS in transit and prevents downgrade attacks. While missing, it's a lesser concern given the strong DMARC/SPF/DKIM posture already in place.
What this means practically
An attacker cannot practically impersonate Trend Micro. Spoofed mail claiming to be from trendmicro.com will fail SPF (no matching IP), and even if it bypassed SPF somehow, DMARC's strict require-alignment policy would reject it unless the mail passed DKIM—which requires a private key the attacker doesn't have. Receivers like Gmail and Microsoft 365 will outright reject such attempts before they reach the user's inbox.
Bottom line: Trend Micro has deployed DMARC, SPF, and DKIM with strict enforcement and no policy carve-outs—a category leader in email security posture that matches its business model as a security vendor.
What we measured
Enforced
DMARC policy
p=reject
DMARC at p=reject (pct=100). Spoofed mail is rejected at SMTP.
Enforced
SPF posture
-all (hardfail)
SPF ends in -all (hardfail). Receivers reject mail from IPs not in the policy.
v=spf1 mx include:_spf-mix.trendmicro.com include:spf-us.tmes.trendmicro.com include:mktomail.com include:spf.mandrillapp.com include:fc1503.cuenote.jp include:spf-euw1.docebopaas.com -all
Enforced
DKIM presence
found at 6 selectors
DKIM key found at selectors: k2, mandrill, s2, selector1, s1, selector2.
Open
MTA-STS (transport)
missing
No MTA-STS policy. Inbound mail can be intercepted via DNS / MX downgrade.
How to make it un-spoofable
- Publish an MTA-STS policy in enforce mode + a TLS-RPT reporting endpoint.