[lisper]

Find me someone in the State Department willing to be the recipient and I will happily conduct this experiment. Why do you think it would be any harder to spoof an email to the State Dept than anywhere else?

[______1]

http://en.wikipedia.org/wiki/Sender_Policy_Framework

[rsanders]

http://mxtoolbox.com/SuperTool.aspx?action=spf%3astate.gov&r....

"No SPF records found"

Looks pretty spoofable.

[lisper]

SPF only validates the envelope, not the From header. To do that you need DKIM, and I'd be surprised if Dept of State has implemented that.