An SPF include for a vendor that no longer exists
Walk a domain’s SPF record with dig, resolve every include, and find the one pointing at a domain that no longer resolves and could be registered by anyone.
Briefing
The marketing team stopped using its old newsletter vendor two years ago. Nobody removed it from SPF.
Each include: in an SPF record pulls in another domain’s list of allowed senders. If that domain expires and someone else registers it, they can publish their own servers and pass SPF for you.
soc-ws · DNS investigation
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.