{"id":"sec-it-email-auth-headers-verdict","audience":"it-security","category":"security","track":"security","technique":"grounding","title":"Read SPF, DKIM and DMARC results from email headers","free":false,"task":"A user forwarded this message's headers. Write exactly 3 numbered lines for SPF, DKIM and DMARC, each as 'SPF: Pass or Fail - quoted header evidence', then a last line 'Verdict: Spoofed' or 'Verdict: Legitimate'. Use only what the headers show. Plain text, under 90 words.","materialLabel":"Message headers (attached to your prompt automatically)","material":"Received: from mail.quickparcel-alerts.example.net (203.0.113.140)\n  by mx1.harborline.example.com; Thu, 6 Nov 2026 09:14:22 -0800\nFrom: \"Harborline Payroll\" <payroll@harborline.example.com>\nReply-To: payroll-help@quickparcel-alerts.example.net\nSubject: Your November payslip is ready\nAuthentication-Results: mx1.harborline.example.com;\n  spf=fail (sender IP 203.0.113.140 is not permitted by domain of harborline.example.com) smtp.mailfrom=harborline.example.com;\n  dkim=none (message not signed);\n  dmarc=fail (p=quarantine) header.from=harborline.example.com\nX-Harborline-Banner: EXTERNAL\n\nNotes from the user: \"It looks exactly like our payroll emails, same logo. Is it real?\"\nOur mail team's note: real payroll mail is sent from 192.0.2.25 and is always DKIM-signed.\nUser's second message: \"My coworker Dana got one too and said hers had a link to view the payslip. I didn't click anything. Should I delete it?\"\nHelp desk ticket: HD-88213, opened 09:31 by the user, category \"suspicious email\", priority normal.","rules":[{"type":"numberedItems","count":3},{"type":"plainText"},{"type":"maxWords","max":90}],"mistakes":[{"title":"Explaining what SPF is","why":"The AI teaches email authentication instead of reading these headers.","fix":"Ask: \"One line each for SPF, DKIM, DMARC: Pass or Fail with quoted evidence.\"","checks":["r0","numberedItems"]},{"title":"No verdict","why":"The AI ends with 'likely suspicious, contact IT'.","fix":"Say: \"Last line: Verdict: Spoofed or Verdict: Legitimate.\"","checks":["r1"]},{"title":"Inventing results","why":"The AI adds checks that aren't in the headers.","fix":"Add: \"Use only what the headers show.\"","checks":["r2"]},{"title":"Trusting the AI to count words","why":"AI is bad at counting. Ask for \"under 90 words\" and it often lands well over.","fix":"Ask for less than the limit and cap each line: \"each line under 15 words, under 70 words total.\"","checks":["maxWords"]},{"title":"Letting markdown in","why":"AI adds bold and headings by default, and in the ticket they show up as stray symbols.","fix":"Add: \"Plain text only, no bold, no headings.\"","checks":["plainText"]}],"promptHints":[{"label":"Names the 3 checks","patterns":["spf","dkim","dmarc"]},{"label":"Asks for a verdict","patterns":["verdict","spoofed","legitimate"]},{"label":"Asks for quoted evidence","patterns":["quote","evidence","header text"]},{"label":"Keeps it to the material","patterns":["only (use )?(the )?(facts|what|info|details)","don'?t (invent|make up|guess|add)","not in the","stick to","nothing (else|extra|outside)"]},{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]}],"hint":"Header analysis is reading, not guessing. Ask for one line per check with the quoted result, and a clear verdict at the end.","rubricLabels":["The 3 lines say SPF: Fail, DKIM: Fail (or none / not signed), and DMARC: Fail, each with quoted header text","The last line is 'Verdict: Spoofed'","Uses only the headers and notes (for example 203.0.113.140 not permitted, message not signed, the quickparcel-alerts Reply-To) and does not invent other header results"]}