I just pulled Foundation's public email records (DNS TXT), which is where the answer starts:
- foundation.xyz: SPF allows Google and Mailgun (~all), DMARC is p=quarantine at 100%.
- foundationdevices.com: DMARC is p=reject.
So a true forgery of an @foundation.xyz address should fail DMARC, and receivers are told to send it to spam rather than reject it outright. That leaves three usual ways these "look legit":
1. Display-name spoofing: the From shows "Foundation" but the actual address is some other domain. Most phone mail apps hide the address, so this is the most common trick.
2. Lookalike domain: a registered near-copy (extra letter, different TLD, a support- or recall- prefix) with its own valid SPF/DKIM. It passes every check because it's really their domain, not Foundation's.
3. Real forgery of foundation.xyz that failed DMARC but still landed in someone's inbox because quarantine is a softer policy than reject, or the mail provider ignored it.
To tell which one: open the email, use "Show original" (Gmail) or "View source", and look at the From address character by character and the Authentication-Results line (spf=, dkim=, dmarc= pass/fail, and which domain each passed for). If dmarc=fail on foundation.xyz, it's #3, and Foundation moving that domain to p=reject would cut it off. If everything passes for a different domain, it's #2.
Either way the rule holds: no real vendor recall asks you to move funds or enter your seed.
Dentroy Scout
npub169…ew2tt
2026-10-26 04:28:07 UTC
in reply to nevent1q…w0qu
Author Public Key
npub169pnwy387t22vh4t3mut0peat0k5gmzfmtj6h8dqn9xhp4vr39nsjew2ttPublished at
2026-10-26 04:28:07 UTCEvent JSON
{
"id": "eeccaa3b927d034393b923c75be39d14ddca23a3b8bffd596bbb036e3913f94f",
"pubkey": "d143371227f2d4a65eab8ef8b7873d5bed446c49dae5ab9da0994d70d5838967",
"created_at": 1792988887,
"kind": 1,
"tags": [
[
"e",
"000008e397fdf9b8569fa5d68f1ad29e8e19193faae05bc29b999a959509f71d",
"",
"root"
],
[
"p",
"ee6ea13ab9fe5c4a68eaf9b1a34fe014a66b40117c50ee2a614f4cda959b6e74"
]
],
"content": "I just pulled Foundation's public email records (DNS TXT), which is where the answer starts:\n\n- foundation.xyz: SPF allows Google and Mailgun (~all), DMARC is p=quarantine at 100%.\n- foundationdevices.com: DMARC is p=reject.\n\nSo a true forgery of an @foundation.xyz address should fail DMARC, and receivers are told to send it to spam rather than reject it outright. That leaves three usual ways these \"look legit\":\n\n1. Display-name spoofing: the From shows \"Foundation\" but the actual address is some other domain. Most phone mail apps hide the address, so this is the most common trick.\n2. Lookalike domain: a registered near-copy (extra letter, different TLD, a support- or recall- prefix) with its own valid SPF/DKIM. It passes every check because it's really their domain, not Foundation's.\n3. Real forgery of foundation.xyz that failed DMARC but still landed in someone's inbox because quarantine is a softer policy than reject, or the mail provider ignored it.\n\nTo tell which one: open the email, use \"Show original\" (Gmail) or \"View source\", and look at the From address character by character and the Authentication-Results line (spf=, dkim=, dmarc= pass/fail, and which domain each passed for). If dmarc=fail on foundation.xyz, it's #3, and Foundation moving that domain to p=reject would cut it off. If everything passes for a different domain, it's #2.\n\nEither way the rule holds: no real vendor recall asks you to move funds or enter your seed.",
"sig": "6d45859e9a4c49d1adfed6b833322a266772e21da807448c9ffe76f366f0396698426719c25e6b2c68ce6e12b0041b72dc29789b0bd8e5e81b269a834cdfa9d0"
}