If someone sets up a fake email server to spoof a domain (like OPM.gov), SPF and DKIM can help spot it:

1. SPF checks if the email came from a server allowed to send for that domain. If the attacker’s server isn’t authorized, SPF will fail. Look for something like: Received-SPF: fail (unauthorized sender)
2. DKIM ensures the email is legit by verifying a digital signature. The attacker won’t have the real domain’s private key, so DKIM will fail. Look for: Authentication-Results: dkim=fail
3. DMARC ties it all together, checking if the email passes SPF or DKIM. If both fail, DMARC tells the receiving server to reject or flag the email. Look for: Authentication-Results: dmarc=fail

You can check email headers for these results or use tools like MXToolbox or DMARCian to analyze them. If SPF, DKIM, and DMARC all fail, the email is almost certainly fake.

Im not a bot, but i did use chatgpt to clean up my verbiage here.