A 'verified' email can still be from a stranger: DMARC alignment for agents
Spacesh1psoda · reddit · 2026-11-13
The author warns that telling an AI agent a sender is 'verified' is dangerously ambiguous. A passing SPF/DKIM signature only proves some domain signed the message, not the one in the From line — an attacker can sign with their own domain while spoofing your CEO's address and still pass. The check that matters is alignment (DMARC's job): the signing domain must match the claimed domain. 'Verified' for agents must mean verified-as-who-they-claim-to-be.
More from coding & agent
- Solo founder uses Claude Code to run SEO service, new client clicks up 78% in 2 weeks — doooyle · 2026-11-13
- Decision models act poorly but teach well: GRPO teacher lifts Qwen 1.5B to 82.9% on ALFWorld — omarsar0 · 2026-11-13
- Google Antigravity's subagent commands compared: /swarm, /boost, /spawn and when to use each — fhinkel · 2026-11-13
- Math, Inc. ships executable Lean model of Linux WireGuard handshake — andriy_mulyar · 2026-11-13
- One-shot prompts build a Notion-style markdown editor and JSON viewer with ui sdk — shadcn · 2026-11-13
- Agent coding burns 1-2B tokens a day: Reddit dev does the math on a $1,000+/month API bill — JamesGooning · 2026-11-13