DMARC adoption in practice: what we see across the domains we assess
A published DMARC record doesn't guarantee correct protection — it only works if the domain in a message's From header aligns with a domain validated by SPF or DKIM, a step many domain owners misconfigure. Across scanned domains, 1 of non-informational email authentication findings trace back to exactly this kind of gap: a missing, misaligned, or non-enforcing record.
What "set up" actually requires
DMARC works by having a domain owner publish a policy in DNS, then having receiving mail servers compare the domain in the message's RFC5322.From field against the results of SPF and DKIM checks and against that published policy, before deciding how to handle the message and reporting back (RFC 7489). That comparison step is where most deployments fail, because SPF and DKIM don't naturally authenticate the same domain that DMARC cares about.
The alignment problem
SPF authenticates the domain used in the SMTP "MAIL FROM" or "HELO" command during the mail transaction — not the RFC5322.From domain a recipient actually sees in their inbox (RFC 7208). DMARC requires that this authenticated domain be aligned with RFC5322.From, either in "relaxed" mode, where the two domains must share the same Organizational Domain, or in "strict" mode, where they must match exactly (RFC 7489). A message that passes SPF with a MAIL FROM of cbg.bounces.example.com and a From address of payments@example.com is aligned in relaxed mode but fails strict mode (RFC 7489).
DKIM alignment works the same way: relaxed mode requires the Organizational Domain of the DKIM "d=" signing domain to match the Organizational Domain of RFC5322.From, while strict mode requires an exact FQDN match (RFC 7489). Mail sent through a third-party platform that signs with its own domain, rather than the sending organization's, will fail alignment even though the DKIM signature itself is valid.
Where records commonly break
Two structural issues show up repeatedly:
Duplicate or conflicting SPF records. A domain must not have more than one SPF record that would cause the authorization check to select more than one — this alone can invalidate the check (RFC 7208).
No definitive policy in the SPF record. If a domain wants receivers to be able to make a negative determination — flagging unauthorized senders — the SPF record has to end in -all or redirect to one that does. Without a record that ends in "-all," no definitive negative authorization determination is possible (RFC 7208).
Organizational Domain miscalculation. DMARC alignment in relaxed mode depends on correctly deriving the Organizational Domain from a public suffix list, and that process is explicitly heuristic — no list is guaranteed accurate or current (RFC 7489). Domains under unusual registration structures can end up with alignment checks that behave unpredictably.
What a correct record still doesn't cover
Even a fully aligned, enforcing DMARC record has defined limits. DMARC is scoped to exact-domain spoofing of RFC5322.From; it does not address visually similar "cousin domains" or abuse of the human-readable display name (RFC 7489). A domain can be configured perfectly by DMARC's own definition and still be impersonated through a look-alike domain that DMARC was never designed to catch.
The numbers
Out of the non-informational findings this check produced across completed scans (2 findings), 1 identified a gap in one of the three mechanisms — record absent, alignment broken, or policy not set to enforce.
For context on scope, 15 of the passive checks attempted in a scan complete successfully (out of 16 attempted), which is the denominator against which the email authentication findings above should be read.
Frequently asked questions
If SPF and DKIM both pass, does DMARC automatically pass?
Not necessarily. DMARC passes only if the SPF- or DKIM-authenticated domain is aligned with the RFC5322.From domain, under either strict or relaxed rules (RFC 7489). A passing SPF or DKIM check on an unaligned domain does not produce a DMARC pass.
What's the practical difference between relaxed and strict alignment?
Relaxed mode allows the authenticated domain and the From domain to differ as long as they share the same Organizational Domain — for example, a subdomain sending on behalf of the main domain. Strict mode requires an exact match of the full domain name (RFC 7489).
Can having two SPF records break authentication even if both look valid?
Yes. The specification requires that a domain not have multiple SPF records that would cause the check to select more than one, and violating this can invalidate the authorization check entirely (RFC 7208).
Does DMARC stop lookalike-domain phishing?
No. DMARC's scope is limited to exact-domain spoofing of the RFC5322.From field; cousin domains and display-name abuse are explicitly out of scope (RFC 7489).
Where to start
Check your domain's email authentication
Sources
---
_Researched with AI assistance from a live passive security scan run by NEL (scan eph_msm811se_187i), which was not retained; citing 2 external sources; 22 factual claims were extracted and checked against their sources (22 of 22 verified); each verification step was independently recorded and signed by Vitna, which attests that the check ran and what its verdict was — not that the underlying claim is true (records 07577ff9-0759-478c-8737-b327dd37ac1d, 4329b3bb-ef9b-4666-80ee-5a24b38f6605, 5af64703-63b2-4fec-8b84-9ec942e40622, +71 more, verify at https://vitna.costrinity.xyz/api/evidence/verify); released automatically after every check above passed; not reviewed by a human before publication; published by NEL Professionals with no individual byline._
Get up to 100 scans or unlimited lifetime access starting at $15.
View Plans →Comments (0)
No comments yet. Be the first to comment!