Standard
Email authentication standard (RFC 7208) letting domain owners publish DNS records naming authorized mail servers, helping detect spoofed senders.
Just 474 of the 1,000 most popular websites set DMARC to reject spoofed mail, a dev.to survey of their DNS found. Thirty-two months after Google and Yahoo began requiring DMARC from bulk senders, 84.5% of the sites publish a record, but only 69.4% apply an enforcing policy to all their mail.
Reality
SEC Consult's Timo Longin found two iCloud Mail flaws letting any signed-in user send SPF-, DKIM- and DMARC-passing mail as any @icloud.com address. A filter that read only those verdicts could not tell the forgeries from mail the real address owner sent.
Reality
Transactional mail can pass SPF and DKIM and still fail DMARC when neither aligns with the visible From domain, a dev.to Node.js guide shows. Because forwarding breaks SPF, the author treats aligned DKIM as the path to protect.
Reality
Publishers onboarding custom domains should confine wildcard DNS to routing and verify three mail records per tenant, a dev.to guide argues. That costs extra writes and waiting, and it gives every customer its own rollback boundary and audit trail.
Reality
The request came from an unauthorized account on a real government domain, and Revolut acted on it. The company calls the number of affected customers limited, and it declined to say how many or name the agency.
Perspective Coverage
5 publishersReality
Publishing p=none starts an XML report feed and enforces nothing. A practitioner sequence for getting a domain to p=reject turns on an owned sender inventory, aligned DKIM and a written condition for each step.
Reality
RFC 9989 removed the pct tag on 19 May 2026, and a record still carrying pct=25 describes a staged rollout that conforming receivers no longer honour. The replacement, t=y, gives one testing step and no percentages.
Reality
In four codebases a dev.to author found bounce handlers that read 5.x.x and stopped, so a receiver's verdict on the sending domain got written down as a dead mailbox. The RFC 3463 subject digit separates the two.
Reality
The DNS and header half of deliverability is a pure function of your own configuration, so a scheduled job can assert it; inbox placement is a measurement you put on a dashboard with a date on it.
Reality
A dev.to walkthrough splits outbound mail by risk profile. Whether that split changes anything for receivers comes down to one tag: sp= on the organizational domain. Subdomains still need their own SPF and DKIM either way.
Reality
The author of DNS Notify lists seven kinds of change alert that mean nothing, and only the first is cured by changing where the query goes. The other six get fixed after the answer arrives.
Reality
A dev.to walkthrough traces a newsletter whose SPF and DKIM both pass for example.net while the visible From reads editorial.example. The evidence that settles it sits in the receiver's Authentication-Results header.
Reality
The request arrived from what looked like a government agency's domain, cleared all three email authentication checks, and Revolut's compliance team processed it. Notifications to affected customers began on September 11.
Reality
A dev.to onboarding design keeps the SPF, DKIM and DMARC values you generated in one row and the answers a resolver returned in another. Its comparator is a single stripped string match, so an SPF value the customer appended to lands in drifted.
Reality
Microsoft Security Research reported over a million emails pairing fake ServiceNow invoices with forged forward threads. No malware ran, so the investigation lives in mail headers and accounting records.
Reality
A genuine Carnival booking confirmation passed SPF, DKIM and DMARC and pointed at a promotional domain the company had let lapse. Someone re-registered it, wired it into a cloaking network, and the link kept routing for 74 days.
Reality
The email telling Trezor owners their recovery phrases might lack entropy came from a real trezor.io address and passed DKIM, SPF and DMARC, and it described a defect close to the one that took 1,778.84 BTC from Coldcard users.
Reality
The native binding wants the Workers Paid plan, and until Cloudflare's SPF, DKIM, DMARC and cf-bounce records are live it will mail only the destinations you verified by hand. That window picks your integration for you.
Reality
The report records valid DNS, SPF and DMARC, no spam and no malware, then returns phishing true at 95. IPQS puts high risk at 85 and above, and that is the line most integrations copy into a signup gate.
Reality
Presence and enforcement are different questions, and the free checkers only answer the first. The switches that matter are the qualifier on SPF's all term and DMARC's p=, sp= and pct= tags.
Reality