DMARC adoption in practice: what we see across the domains we assess
Most DMARC failures aren't about missing records but broken configurations: 1 of non-informational email authentication findings trace to misconfigured SPF, DKIM, or DMARC rather than their absence. Even properly aligned DMARC has limits — it only authenticates the RFC5322.From domain, leaving display names and lookalike "cousin domains" unaddressed, and it depends on domain owners actually reading the feedback reports receivers send.
What DMARC is actually checking
DMARC is not a single yes/no setting. A receiver checks the RFC5322.From address against the SPF and DKIM results and the DMARC policy published in DNS, then decides how to handle the mail and, separately, sends a report back to the domain owner about mail claiming to be from that domain (RFC 7489). Each of those steps is a place a "correctly configured" record can quietly stop functioning.
Alignment is where records that look fine actually fail
DMARC doesn't just check whether SPF or DKIM passed — it checks whether the domain that passed SPF or DKIM matches the domain in the From address, a requirement called Identifier Alignment (RFC 7489). This check can run in "strict" or "relaxed" mode, and the two give different results for the same message.
For DKIM: in relaxed mode, a signature with d=example.com aligns with a From address of alerts@news.example.com, because both share the same organizational domain. In strict mode, that same signature fails alignment, because the domains aren't an exact match (RFC 7489).
For SPF: in relaxed mode, a message that passes SPF against cbg.bounces.example.com aligns with a From address of payments@example.com. In strict mode, it doesn't (RFC 7489). This is the exact pattern created by many third-party senders — marketing platforms, invoicing tools, ticketing systems — that sign or send mail from their own subdomain while the organization's brand appears in the From address. If the policy mode and the sending setup don't match, mail from a legitimate service can fail DMARC even though SPF or DKIM individually passed.
SPF failure modes that undercut DMARC before it starts
A domain must not publish more than one SPF record — if an authorization check would select more than one, that's a violation of the record selection rules, and without a single record, "no definitive determination of authorization can be made" (RFC 7208). A record without an explicit "all" or "redirect" is still valid, since there is an implicit ?all at the end, but it's better to explicitly terminate processing with an all mechanism or redirect modifier, as RFC 7208 notes.
The reporting loop most domains skip
DMARC's design assumes the domain owner is reading the reports receivers send back. The RFC is explicit about why this matters: without feedback reports, "originators who have implemented email authentication have difficulty determining how effective their authentication is," and as a result, authentication failures often can't be used to filter mail with any confidence (RFC 7489).
What DMARC doesn't cover
Even a well-aligned, well-monitored DMARC deployment has a defined boundary. DMARC evaluates the RFC5322.From domain only — it does not authenticate the human-readable display name, and it does not address visually similar "cousin domains" registered by an attacker (RFC 7489).
The numbers
Looking at the non-informational findings that check produced, 1 were tied to a configuration problem with one of these three mechanisms, out of 2 findings reviewed. The email authentication check is one of several passive checks that run in each scan; across the scans behind this data, 15 of 16 attempted checks completed, which is the base we're drawing these findings from.
Frequently asked questions
If SPF and DKIM both pass, does DMARC automatically pass too?
No. DMARC also requires that the domain validated by SPF or DKIM be aligned with the domain in the message's visible From address. A message can have valid SPF and a valid DKIM signature from a completely different domain and still fail DMARC because neither is aligned with the From address (RFC 7489).
What's the difference between strict and relaxed alignment?
Relaxed mode only requires the authenticated domain and the From address domain to share the same organizational domain — subdomains are fine. Strict mode requires an exact match between the fully qualified domain names (RFC 7489).
Can a domain have two SPF records?
No. A domain name must not have multiple records that would cause an SPF authorization check to select more than one (RFC 7208). Leftover records from a platform migration are a common way this happens by accident.
Does DMARC stop phishing that uses a lookalike domain?
No. DMARC's scope is limited to the exact domain in the RFC5322.From field. It does not evaluate cousin domains or the display name shown to the recipient, so a convincing lookalike domain with its own clean SPF, DKIM, and DMARC records will pass DMARC on its own domain (RFC 7489).
Why would a DMARC record with a strong policy still not be "working"?
DMARC's design assumes the domain owner is actually reading the feedback reports receivers send back. Without that feedback, a domain owner has no reliable way to know whether legitimate mail is failing alignment or whether the policy is doing what they intended (RFC 7489).
Where to start
Check your domain's email authentication
Sources
---
_Researched with AI assistance from a live passive security scan run by NEL (scan eph_msm7l8kd_f3x), which was not retained; citing 2 external sources; 25 factual claims were extracted and checked against their sources (24 of 25 verified); each verification step was independently recorded and signed by Vitna, which attests that the check ran and what its verdict was — not that the underlying claim is true (records e7fa28f0-26b5-402c-a7b4-8cadda44c190, 6ba41ae8-b5b8-44b0-9c70-600eaff1de6f, a7f2d773-e941-4165-9d9d-68419cd5ff35, +114 more, verify at https://vitna.costrinity.xyz/api/evidence/verify); reviewed and approved by admin:nelnationale before publishing; published by NEL Professionals with no individual byline._
Get up to 100 scans or unlimited lifetime access starting at $15.
View Plans →Comments (0)
No comments yet. Be the first to comment!