Library › Cybersecurity AI › IT and security teams

Read SPF, DKIM and DMARC results from email headers

  • For IT and security teams
  • You practice Keeping the AI to your sources
  • Time about 5 minutes

About this exercise

A user forwarded this message's headers. Write exactly 3 numbered lines for SPF, DKIM and DMARC, each as 'SPF: Pass or Fail - quoted header evidence', then a last line 'Verdict: Spoofed' or 'Verdict: Legitimate'. Use only what the headers show. Plain text, under 90 words.

Common mistakes when you ask AI for this

  • Explaining what SPF is. The AI teaches email authentication instead of reading these headers. Try: Ask: "One line each for SPF, DKIM, DMARC: Pass or Fail with quoted evidence."
  • No verdict. The AI ends with 'likely suspicious, contact IT'. Try: Say: "Last line: Verdict: Spoofed or Verdict: Legitimate."
  • Inventing results. The AI adds checks that aren't in the headers. Try: Add: "Use only what the headers show."
  • Trusting the AI to count words. AI is bad at counting. Ask for "under 90 words" and it often lands well over. Try: Ask for less than the limit and cap each line: "each line under 15 words, under 70 words total."
  • Letting markdown in. AI adds bold and headings by default, and in the ticket they show up as stray symbols. Try: Add: "Plain text only, no bold, no headings."

What a strong prompt includes

  • Names the 3 checks
  • Asks for a verdict
  • Asks for quoted evidence
  • Keeps it to the material
  • Asks for plain text

Practice this now ↑

Related exercises