Project 55: Email Spoofing Defense

Module: Module 6: Applied Web Security & Defensive Automation  |  Level: Intermediate  | 
Primary tool: dig (for SPF/DKIM/DMARC record lookup)  |  Estimated time: 75–120 minutes

Objective: Audit whether a domain’s anti-spoofing DNS records are correctly configured.

Free lab environment

Your own free-tier mail domain (e.g. via a free Mailtrap/Mailgun sandbox) — https://mailtrap.io/

Use a sandboxed email-testing service (free tier) so test messages never reach a real inbox. Never send spoofed mail to a real third-party address as part of this course.

Lab workflow

1. Set up dig (for SPF/DKIM/DMARC record lookup) so no test message can ever reach a real inbox.
2. Using your sandbox, work through the exercise with the specific goal of learning to audit whether a domain’s anti-spoofing DNS records are correctly configured.
3. Inspect the raw email headers (not just the rendered message) — this is where the real evidence lives.
4. Identify the specific authentication result (SPF/DKIM/DMARC pass/fail) and what it means.
5. Write the specific configuration change (policy, record, or setting) that would close the gap you found.
6. Capture the screenshots specified below as your evidence trail.

Evidence & screenshot requirements

Submit the following with your report (see this module’s practical assignment for exact upload details):

• `dig TXT` output for your domain’s SPF and DMARC records
• your written assessment of whether the policy is ‘none’ (monitoring only) vs. ‘reject’ (enforcing), and why that matters

Expected deliverable

A concise lab-report entry containing: scope/target, exact commands or payloads used, your key
observation, the required screenshots above, and — where applicable — the specific remediation for what
you found. Vague answers (“sanitize input”, “use a firewall”) without naming the exact mechanism will not
receive full credit.

Safety & authorization

Only test the specific free lab target named above, or infrastructure you personally own. Do not target
third-party systems, real user accounts, or production services without explicit written authorization.
Never deploy anything from this project outside an isolated lab environment.