Spoofability verdict for x.com
No - x.com is not practically spoofable.
See the math
X.com has locked down its email domain with hard authentication rules: DMARC reject, SPF hardfail, and active DKIM signing. This is how a major platform prevents imposters from sending mail on its behalf.
- DMARC p=reject (enforced): Any email claiming to come from x.com that fails DMARC authentication is rejected outright by receiving mailboxes. This is the strongest DMARC policy and closes off the most direct spoofing vector.
- SPF -all hardfail (enforced): SPF explicitly forbids any IP address not in their whitelist from sending mail as x.com. The list includes X's own ranges plus Google, Salesforce, and Oracle email platforms. Any server not on that list will fail SPF.
- DKIM (google selector found): DKIM signatures cryptographically prove mail actually came from X's infrastructure. We found active signing; attackers cannot forge a valid signature without X's private key.
- MTA-STS missing: MTA-STS would enforce encrypted connections to X's mail servers and is a nice-to-have for freshly deployed domains, but its absence does not materially weaken the DMARC + SPF + DKIM posture already in place.
What this means practically
An attacker cannot send mail that will successfully arrive to recipients claiming to come from x.com. DMARC reject, SPF hardfail, and working DKIM signatures together mean that Gmail, Outlook, and corporate mail systems will reject or heavily filter any spoofed attempt. Even a sophisticated attacker with access to some cloud infrastructure cannot forge a DKIM signature; they would need X's actual mail signing keys.
Bottom line: X.com's email domain is genuinely protected; this is a textbook example of authentication done right and worth studying if your own domain is still on the default.
What we measured
Enforced
DMARC policy
p=reject
DMARC at p=reject (pct=100). Spoofed mail is rejected at SMTP.
Enforced
SPF posture
-all (hardfail)
SPF ends in -all (hardfail). Receivers reject mail from IPs not in the policy.
v=spf1 ip4:199.16.156.0/22 ip4:199.59.148.0/22 include:_spf.google.com include:_spf.salesforce.com include:_oerp.x.com include:phx1.rp.oracleemaildelivery.com include:iad1.rp.oracleemaildelivery.com -all
Enforced
DKIM presence
found at 1 selector
DKIM key found at selector: google.
Open
MTA-STS (transport)
missing
No MTA-STS policy. Inbound mail can be intercepted via DNS / MX downgrade.
How to make it un-spoofable
- Publish an MTA-STS policy in enforce mode + a TLS-RPT reporting endpoint.