Who is really signing this?

Medium · 25 points

Below is a set of DNS records for a made-up domain that is having trouble with spoofed mail.

There is exactly one reason mail claiming to be from this domain still passes basic checks when sent from an unrelated server. Find the record that is wrong, and submit the mechanism that makes it permissive as the flag, for example skrd{+all}.

Read the SPF record carefully. The last token is the whole answer.

Artefact

example.com.        IN  MX    10 mail.example.com.
example.com.        IN  TXT   "v=spf1 a mx include:_spf.example.net ?all"
_dmarc.example.com. IN  TXT   "v=DMARC1; p=none; rua=mailto:dmarc@example.com"
mail._domainkey.example.com. IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBg..."

Hint

SPF ends with a qualifier telling the receiver what to do with everything else. There are four: +, -, ~ and ?. Only one of them means "no opinion".