Could AI/ML be used to evaluate authentication trustworthiness?

It already is. Major mailbox providers like Gmail and Outlook have been using machine learning to evaluate sender reputation and authentication signals for years. The interesting question is what that evaluation actually looks at.

Authentication checks (SPF, DKIM, DMARC) are binary: pass or fail. Machine learning looks at the patterns around those results. Things like: does this domain always pass authentication, or does it have a spotty history? Does the DKIM signature come from a new or established selector? Does the sending IP have a consistent authentication track record? Is the authentication configuration consistent with other signals, or does it look like it was set up specifically to avoid detection?

ML can also detect authentication abuse, like domains that pass all checks but were registered last week specifically to run a phishing campaign, or senders that pass authentication but whose content patterns correlate with known spam templates. Passing DMARC is necessary but not sufficient to look trustworthy to a machine learning classifier.

On the defensive side, ML helps spot anomalous authentication behavior that might indicate a compromised key or infrastructure being impersonated. If your DKIM signatures suddenly start appearing from unfamiliar selectors or IPs, that's an anomaly worth flagging.

For senders, the practical implication is that consistent, long-established authentication is better than technically correct but recent. A domain with a two-year history of clean authentication signals looks more trustworthy to ML systems than one that just added SPF/DKIM/DMARC yesterday. Authentication is a necessary signal. History is what makes it credible.