wiredepth
Run a check

Which education brands can be spoofed in email?

Universities and education domains are notoriously stuck at DMARC p=none. It's not laziness - the legitimate-sender complexity is real (departments, alumni mailers, third-party Listservs, student-org accounts). The legitimate-reason context matters, but the practical impact is the same: spoofable.

Spoofable

1 (8%)

No DMARC, or DMARC at p=none. Anyone can send from these domains.

Partial protection

5 (42%)

DMARC at p=quarantine, or p=reject with pct<100. Spoofed mail may slip through.

Not practically spoofable

6 (50%)

DMARC p=reject pct=100 + SPF -all or DKIM. Spoofed mail rejected at SMTP.

BrandDomainVerdict
MITmit.eduSpoofableSee the math →
Harvardharvard.eduMaybeSee the math →
Stanfordstanford.eduMaybeSee the math →
University of Oxfordox.ac.ukMaybeSee the math →
Yaleyale.eduMaybeSee the math →
edXedx.orgMaybeSee the math →
Berkeleyberkeley.eduProtectedSee the math →
Cambridgecam.ac.ukProtectedSee the math →
Courseracoursera.orgProtectedSee the math →
Duolingoduolingo.comProtectedSee the math →
Khan Academykhanacademy.orgProtectedSee the math →
Udemyudemy.comProtectedSee the math →

Other categories

What does "spoofable" actually mean?

A domain is spoofable when a third party can send mail FROM addresses at that domain (e.g. [email protected]) and have it land in inboxes. The mechanism that prevents this is DMARC enforcement combined with SPF and DKIM. Without all three, receivers have no policy to apply against unauthorised senders.

Want the same check on your own domain? Run the free Spoofability check.

This category last scored: .