http://mxtoolbox.com/SuperTool.aspx?action=spf%3astate.gov&r....

"No SPF records found"

Looks pretty spoofable.

SPF only validates the envelope, not the From header. To do that you need DKIM, and I'd be surprised if Dept of State has implemented that.