Valid DMARC and No Alignment Still Leave Impersonation Risk

DMARC is often mistaken for a guarantee that an email genuinely came from the named organisation. In reality, it is a shared rule for authenticating domain use and telling receiving mail systems what to do when that use cannot be confirmed. A published policy does not establish who controls an account or whether a request is honest.

A domain with a valid DMARC policy but no alignment is still an impersonation risk because the message may fail authentication while a weak policy allows delivery. Even a passing result proves only that SPF or DKIM aligned with the visible From domain; it cannot prove that the sender’s account is uncompromised. Attackers exploit that distinction by placing fraudulent messages inside a trusted brand’s façade.

This matters in Australia, where organisations in Sydney, Melbourne and other business centres commonly operate Microsoft 365 or Google Workspace mail systems. A sound configuration can still be undermined by account takeover, forwarding or a lookalike domain. The Australian Signals Directorate’s Essential Eight likewise frames email and identity controls as part of a broader security posture rather than one isolated checkbox.

What DMARC validity actually means

A valid policy confirms that a DMARC record can be found and parsed. It does not mean every message passes DMARC, that every sending service is healthy, or that the visible sender is trustworthy. With no aligned SPF or DKIM domain, the message is unauthenticated for DMARC purposes; protection then depends on how the receiver handles that failure.

SPF authenticates the MAIL FROM domain used during sending, while aligned DKIM authenticates a signing domain matching the RFC 5322 From domain. Either mechanism can pass while alignment fails. The ultimate DMARC guide explains the DNS records and testing stages for separating configuration errors from deliberate spoofing.

Why attackers keep a convincing disguise

Attackers can put a real organisation’s display name beside a lookalike domain, alter reply-to details, or conceal a misleading destination in shortened text. Australia’s .com.au eligibility rules make casual misuse of a registered .com.au domain harder, but they do not authenticate mail or prevent deceptive names outside that namespace.

A second pattern starts with account compromise. If criminals send through an authorised Microsoft 365 or Google Workspace tenant, SPF or DKIM may align, causing DMARC to pass even though no legitimate user initiated the message. Benign forwarding creates a parallel problem: authentication can break, producing noisy failures that gradually train staff to ignore warnings.

Combine authentication with contextual signals

On mobile phones, Australian office staff often see a sender name, subject and opening lines before inspecting full headers. That makes visual impersonation persuasive, especially when a message creates urgency around an invoice, payroll change or account update. Trusted Sender Score’s domain reputation guide explains how reputation evidence can reinforce phishing awareness training.

Authentication should be considered with reply-to addresses, link destinations, tone, attachments and recent account changes. A passing DMARC result can support a compromised tenant, while a failing result may reflect a harmless mailing list. Treating either result as absolute creates blind spots in both directions.

Match policy strength to the threat

A DMARC record beginning p=none asks receivers for no special action on failure. Quarantine asks them to isolate failing mail, while reject asks them to refuse it. The pct setting can stage enforcement, so an organisation with partial deployment must not describe its domain as fully protected against spoofing.

Receivers also apply their own filtering and threat intelligence. If staff rely on visible From information, weak alignment enforcement and delayed quarantine, a valid-looking domain can still put fraudulent content in front of a user. Monitoring aggregate reports helps reveal new legitimate senders and unexplained failures before enforcement blocks business mail.

Preserve trust through email journeys

Legitimate email journeys complicate alignment. Mailing lists, ticket systems, shared archives and security gateways can rewrite the From domain while preserving a trusted name elsewhere. Blind forwarding commonly strips SPF and DKIM, producing false DMARC failures that should be resolved rather than explained away.

Authenticated Received Chain Conformance can carry validation results across forwarding paths, but it must operate as a trustworthy chain. TLS-RPT helps domain operators investigate SMTP encryption failures, while aligned DKIM or S/MIME can provide stronger evidence of message origin. These controls complement DMARC; they do not make an unauthorised account safe.

Build a layered response plan

Map authorised senders, DKIM selectors, subdomains and third-party services before tightening enforcement. Check inherited SPF records for excess lookups, remove obsolete keys, and test every high-volume source. Bulk domain checks and an integration API can make this inventory repeatable for security teams and domain owners.

When a legitimate service changes or is compromised, evidence must be compared quickly. The low-score recovery guide provides a practical sequence for reviewing DNS, sending-source and reputation changes before blaming users. Preserve complete headers and logs, then compare failing messages with known-good samples.

A suspected incident may also involve personal information. Under the Privacy Act 1988 and the Australian Privacy Principles, phishing that causes unauthorised access, use or disclosure of personal information may be a notifiable data breach, requiring assessment and notification when the scheme’s threshold is met. Escalate qualifying incidents to the privacy or legal owner and relevant providers. DMARC is strongest when authentication, reputation and incident response form one evidence set.