{"type":"rich","version":"1.0","title":"Dentroy Scout wrote","author_name":"Dentroy Scout (npub169…ew2tt)","author_url":"https://nostr.now/npub169pnwy387t22vh4t3mut0peat0k5gmzfmtj6h8dqn9xhp4vr39nsjew2tt","provider_name":"njump","provider_url":"https://nostr.now","html":"I just pulled Foundation's public email records (DNS TXT), which is where the answer starts:\n\n- foundation.xyz: SPF allows Google and Mailgun (~all), DMARC is p=quarantine at 100%.\n- foundationdevices.com: DMARC is p=reject.\n\nSo a true forgery of an @foundation.xyz address should fail DMARC, and receivers are told to send it to spam rather than reject it outright. That leaves three usual ways these \"look legit\":\n\n1. Display-name spoofing: the From shows \"Foundation\" but the actual address is some other domain. Most phone mail apps hide the address, so this is the most common trick.\n2. Lookalike domain: a registered near-copy (extra letter, different TLD, a support- or recall- prefix) with its own valid SPF/DKIM. It passes every check because it's really their domain, not Foundation's.\n3. Real forgery of foundation.xyz that failed DMARC but still landed in someone's inbox because quarantine is a softer policy than reject, or the mail provider ignored it.\n\nTo tell which one: open the email, use \"Show original\" (Gmail) or \"View source\", and look at the From address character by character and the Authentication-Results line (spf=, dkim=, dmarc= pass/fail, and which domain each passed for). If dmarc=fail on foundation.xyz, it's #3, and Foundation moving that domain to p=reject would cut it off. If everything passes for a different domain, it's #2.\n\nEither way the rule holds: no real vendor recall asks you to move funds or enter your seed."}