Why DKIM-only DMARC still leaves a domain exposed to spoofing
A domain can report DMARC as “pass” even when SPF fails. This happens when the message carries a valid DKIM signature aligned with the visible From domain. DMARC uses either aligned SPF or aligned DKIM to authenticate a message, so one successful mechanism is enough for a pass.
That result is useful, but it does not mean the domain has comprehensive email protection. A DKIM-only pass can conceal weaknesses in sending services, forwarding paths, subdomains and vendor configurations. Attackers may still exploit those gaps to impersonate a business or create convincing lookalike messages.
For Australian organisations, this matters across everyday email such as invoices, payroll notices, parcel updates and customer service messages. A spoofed message appearing to come from a Melbourne retailer, a Brisbane trades business or a .au domain can quickly become a payment or credential theft incident.
| Configuration | What it confirms | Remaining exposure |
|---|---|---|
| DKIM passes, SPF fails | The signing key and aligned domain were accepted | SPF coverage, forwarding and vendor paths may be incomplete |
| SPF passes, DKIM fails | The authorised sending IP was recognised | Forwarding, message alteration and signing failures remain possible |
| Both pass and align | Two independent authentication signals work | Compromised keys, lookalike domains and weak policy can still matter |
Both fail with p=none |
The message was observed but not blocked | Spoofed mail can continue reaching recipients |
What a DKIM-only DMARC pass actually means
DKIM attaches a cryptographic signature to selected message content. The receiving server checks that signature against a public key published in DNS, then compares the signing domain with the domain shown in the From address. When both checks succeed, DMARC can pass even if the return-path domain fails SPF.
This is often seen when a marketing platform, helpdesk or cloud mailbox provider signs messages on a company’s behalf. The arrangement may be legitimate, yet it can leave the organisation with no reliable SPF authorisation for that service. A passing DKIM result therefore describes one valid path, not every system allowed to send mail.
Why SPF failure still matters
SPF identifies the servers permitted to send mail for a domain’s envelope sender. It is especially relevant to bounce handling, forwarding behaviour and services that do not support DKIM correctly. If SPF fails, messages from an authorised business platform may be rejected or quarantined when the DKIM signature is missing, altered or misconfigured.
Forwarding creates another complication. A receiving gateway can preserve DKIM while changing the SMTP path, causing SPF to fail. That means DKIM may be the only reason a legitimate message survives, while a different legitimate sender without robust signing is treated as suspicious. Uneven coverage makes delivery and fraud controls harder to predict.
How attackers can use the gaps
An attacker cannot simply make an arbitrary message pass DKIM without access to a valid private key. However, many organisations use multiple external senders, and one poorly managed service can become the weak link. An abandoned vendor account, exposed signing key or incorrectly delegated sending service may allow malicious mail to authenticate under the brand.
Spoofing also extends beyond the exact domain protected by DMARC. An organisation may secure example.com while leaving subdomains, newly registered lookalike domains or a similar .com.au address available for impersonation. Display-name fraud can make a message appear to come from a familiar Australian bank, supplier or government service even when the technical domain differs.
Policy strength determines the practical result
A DMARC pass does not show whether the domain’s policy is set to monitor, quarantine or reject. With p=none, recipients receive reporting instructions but are free to deliver unauthorised messages. A domain passing DMARC through DKIM can therefore have excellent authentication data and weak enforcement at the same time.
Quarantine and reject policies provide stronger protection, but they should follow careful monitoring. Businesses need to identify legitimate senders, align domains, review aggregate reports and test subdomain behaviour before tightening enforcement. The trust score guide can help place authentication results alongside wider domain reputation signals.
Australian email operations need broader coverage
Australian organisations often combine Microsoft 365 or Google Workspace with local accounting platforms, property systems, delivery services and marketing providers. A Sydney agency may send newsletters through one platform, invoices through another and support messages through a third. If only one service signs with aligned DKIM, the domain can appear healthy while other routes remain unreliable or exposed.
The Spam Act 2003 governs commercial electronic messages in Australia, including consent and unsubscribe requirements, but compliance does not replace authentication. Scamwatch warnings, customer expectations and privacy obligations also make impersonation costly. A strong email programme should connect legal compliance, sender inventory, domain monitoring and technical controls rather than treating a DMARC pass as a complete security verdict.
Building a more resilient authentication setup
Start by listing every approved sender, including cloud platforms, payroll providers, CRM systems and transactional email services. Publish an SPF record that stays within the DNS lookup limit, remove obsolete mechanisms and configure DKIM for each provider. Each service should use an aligned domain where possible, rather than relying on a shared provider domain.
Review DMARC aggregate reports for SPF failures, DKIM failures, unexpected countries and unfamiliar infrastructure. Monitor MX records as well as authentication because mail-routing changes can affect delivery and expose operational mistakes; ongoing MX record monitoring provides useful context.
A domain with DKIM passing and SPF failing is better protected than one with both mechanisms failing, but it is not fully hardened. Reliable anti-spoofing depends on aligned authentication across all legitimate senders, an enforced DMARC policy, protected signing keys and continuous visibility into domain reputation and mail flow.