Email Domain Security — Spoofability Verdict & SPF Supply-Chain Analysis

Companion skills: offensive-osint §16.14 (raw record-fetch recipes — dig/PowerShell one-liners for SPF/DMARC/DKIM/BIMI/MTA-STS/TLS-RPT/DNSSEC/CAA, the MX→IdP inference table, the DMARC reporting-vendor table). osint-methodology (confidence levels, output format, severity rubric this skill inherits). Fetch the records with §16.14 first; bring the raw TXT text here for the verdict. This skill does not re-list what a record is — it reasons about what a domain's combination of records actually lets an attacker do.

0. When to Use / When NOT

Use this skill when:

• Asked to audit spoof feasibility, produce an email-spoofability verdict, or explain "is domain X spoofable."
• You already have raw SPF/DMARC TXT text (via offensive-osint §16.14 or your own dig) and need the verdict, not just the record dump.
• Investigating an SPF PermError, a long or unusual include chain, or a dead include: target.
• Writing a client-facing finding that has to survive the pushback "we have SPF -all, why is this flagged?"
• Reasoning about DMARC subdomain policy inheritance, pct= partial enforcement, or duplicate-record handling.

Do NOT use this skill when: