Standard
DMARC (RFC 7489) is an email authentication standard built on SPF and DKIM, letting domain owners set policies for unauthenticated mail and get reports.
Just 474 of the 1,000 most popular websites set DMARC to reject spoofed mail, a dev.to survey of their DNS found. Thirty-two months after Google and Yahoo began requiring DMARC from bulk senders, 84.5% of the sites publish a record, but only 69.4% apply an enforcing policy to all their mail.
Reality
SEC Consult's Timo Longin found two iCloud Mail flaws letting any signed-in user send SPF-, DKIM- and DMARC-passing mail as any @icloud.com address. A filter that read only those verdicts could not tell the forgeries from mail the real address owner sent.
Reality
Transactional mail can pass SPF and DKIM and still fail DMARC when neither aligns with the visible From domain, a dev.to Node.js guide shows. Because forwarding breaks SPF, the author treats aligned DKIM as the path to protect.
Reality
GitHub's SPF record uses all 10 DNS lookups RFC 7208 allows once the includes inside its vendors' records are counted. One more mail vendor would make SPF return PermError and leave GitHub's mail to pass DMARC on DKIM alone.
Reality
Publishers onboarding custom domains should confine wildcard DNS to routing and verify three mail records per tenant, a dev.to guide argues. That costs extra writes and waiting, and it gives every customer its own rollback boundary and audit trail.
Reality
The request came from an unauthorized account on a real government domain, and Revolut acted on it. The company calls the number of affected customers limited, and it declined to say how many or name the agency.
Perspective Coverage
5 publishersReality
Publishing p=none starts an XML report feed and enforces nothing. A practitioner sequence for getting a domain to p=reject turns on an owned sender inventory, aligned DKIM and a written condition for each step.
Reality
A dev.to walkthrough stores the provider's DNS zone ID as replaceable cache and checks the returned domain before every mutation. The cutover only closes when an independent DNS read matches the approved MX set.
Reality
A dev.to post on healthtech workspace joining argues that DNS TXT challenges and mailbox confirmations prove different things, and the Go example it ships bounds DNS freshness at 24 hours while leaving the mailbox proof undated.
Reality
A dev.to walkthrough of per-tenant subdomains on a gaming platform gives the TTL drop, the target change and the TTL restore separate deadlines, preconditions and audit evidence, so a worker that restarts can prove what it already applied.
Reality
RFC 9989 removed the pct tag on 19 May 2026, and a record still carrying pct=25 describes a staged rollout that conforming receivers no longer honour. The replacement, t=y, gives one testing step and no percentages.
Reality
In four codebases a dev.to author found bounce handlers that read 5.x.x and stopped, so a receiver's verdict on the sending domain got written down as a dead mailbox. The RFC 3463 subject digit separates the two.
Reality
The DNS and header half of deliverability is a pure function of your own configuration, so a scheduled job can assert it; inbox placement is a measurement you put on a dashboard with a date on it.
Reality
A dev.to walkthrough splits outbound mail by risk profile. Whether that split changes anything for receivers comes down to one tag: sp= on the organizational domain. Subdomains still need their own SPF and DKIM either way.
Reality
A dev.to runbook for property-management DNS ties every record to a property ID, plans each delete against an expected current value, and calls the job done only once resolver checks agree.
Reality
A dev.to walkthrough of FastAPI onboarding separates two proofs that codebases keep merging, one testing whether a person can read mail at a domain and the other whether anyone can write to its zone. Negative caching explains why the first check fails.
Reality
A dev.to walkthrough traces a newsletter whose SPF and DKIM both pass for example.net while the visible From reads editorial.example. The evidence that settles it sits in the receiver's Authentication-Results header.
Reality
A dev.to design post writes an attempt row before every provider call and keeps accepted apart from delivered across six states, paying extra latency where the API publishes no idempotent-send contract.
Reality
The request arrived from what looked like a government agency's domain, cleared all three email authentication checks, and Revolut's compliance team processed it. Notifications to affected customers began on September 11.
Reality
A dev.to onboarding design keeps the SPF, DKIM and DMARC values you generated in one row and the answers a resolver returned in another. Its comparator is a single stripped string match, so an SPF value the customer appended to lands in drifted.
Reality