- DMARC's actual scope is narrow: it only verifies whether the visible From domain authorized a message through aligned SPF/DKIM, not spam or phishing.
- Three key terms: SPF lists authorized sending servers, DKIM provides a cryptographic signature, and DMARC ties either back to the visible From address.
- Email has two 'from' addresses: envelope for routing and visible From for display; DMARC ensures authentication aligns with the visible one.
- DMARC records live in DNS; examples show SPF, DKIM, and DMARC record syntax.
- A DMARC pass requires either SPF or DKIM to authenticate and align with the visible From domain; relaxed mode allows same organizational domain, strict requires exact match.
- DMARC does not inspect content—only provenance, leaving body, links, attachments, and intent unverified.
- DMARC effectively stops exact-domain spoofing and provides aggregate reports to discover unauthorized senders.
- DMARC fails to address lookalike domains, display-name impersonation, compromised mailboxes, authenticated malicious domains, spam filtering, and breaks with forwarding/mailing lists.
- A DMARC pass confirms authorization, not trustworthiness; vendors overstating its phishing prevention leave users exposed.
- Proper DMARC enforcement requires careful monitoring and remediation, not a blind switch to p=reject.