Topic
DKIM and DMARC are email authentication standards using DNS-published cryptographic signatures and policy records to verify sender domains and curb spoofing.
RFC 9990 says DMARC aggregate reports typically cover a single UTC day starting at 0000UTC, and RFC 9989 has no interval tag to change that. A dev.to write-up says a new domain's first report arrives a day or more after publication, so teams should test their pipeline first.
Reality
Just 474 of the 1,000 most popular websites set DMARC to reject spoofed mail, a dev.to survey of their DNS found. Thirty-two months after Google and Yahoo began requiring DMARC from bulk senders, 84.5% of the sites publish a record, but only 69.4% apply an enforcing policy to all their mail.
Reality
A fake recruiter impersonating Ethereum rollup company Taiko kept serving its job-offer trojan four days after a developer reported it to AWS. It ends the hiring flow by asking the candidate to paste a command into their terminal, a step no legitimate hiring process requires.
Reality
SEC Consult's Timo Longin found two iCloud Mail flaws letting any signed-in user send SPF-, DKIM- and DMARC-passing mail as any @icloud.com address. A filter that read only those verdicts could not tell the forgeries from mail the real address owner sent.
Reality
Transactional mail can pass SPF and DKIM and still fail DMARC when neither aligns with the visible From domain, a dev.to Node.js guide shows. Because forwarding breaks SPF, the author treats aligned DKIM as the path to protect.
Reality
GitHub's SPF record uses all 10 DNS lookups RFC 7208 allows once the includes inside its vendors' records are counted. One more mail vendor would make SPF return PermError and leave GitHub's mail to pass DMARC on DKIM alone.
Reality
Publishers onboarding custom domains should confine wildcard DNS to routing and verify three mail records per tenant, a dev.to guide argues. That costs extra writes and waiting, and it gives every customer its own rollback boundary and audit trail.
Reality
The request came from an unauthorized account on a real government domain, and Revolut acted on it. The company calls the number of affected customers limited, and it declined to say how many or name the agency.
Perspective Coverage
5 publishersReality
Publishing p=none starts an XML report feed and enforces nothing. A practitioner sequence for getting a domain to p=reject turns on an owned sender inventory, aligned DKIM and a written condition for each step.
Reality
RFC 9989 removed the pct tag on 19 May 2026, and a record still carrying pct=25 describes a staged rollout that conforming receivers no longer honour. The replacement, t=y, gives one testing step and no percentages.
Reality
In four codebases a dev.to author found bounce handlers that read 5.x.x and stopped, so a receiver's verdict on the sending domain got written down as a dead mailbox. The RFC 3463 subject digit separates the two.
Reality
The DNS and header half of deliverability is a pure function of your own configuration, so a scheduled job can assert it; inbox placement is a measurement you put on a dashboard with a date on it.
Reality
A dev.to walkthrough splits outbound mail by risk profile. Whether that split changes anything for receivers comes down to one tag: sp= on the organizational domain. Subdomains still need their own SPF and DKIM either way.
Reality
A dev.to runbook for property-management DNS ties every record to a property ID, plans each delete against an expected current value, and calls the job done only once resolver checks agree.
Reality
A dev.to walkthrough traces a newsletter whose SPF and DKIM both pass for example.net while the visible From reads editorial.example. The evidence that settles it sits in the receiver's Authentication-Results header.
Reality
The request arrived from what looked like a government agency's domain, cleared all three email authentication checks, and Revolut's compliance team processed it. Notifications to affected customers began on September 11.
Reality
A dev.to onboarding design keeps the SPF, DKIM and DMARC values you generated in one row and the answers a resolver returned in another. Its comparator is a single stripped string match, so an SPF value the customer appended to lands in drifted.
Reality
The decision to automate tenant subdomains turns on whether you can test intent, confirm the authoritative answer and reverse a record, and a dev.to field guide keeps a checklist for anything below that bar.
Reality
Microsoft Security Research reported over a million emails pairing fake ServiceNow invoices with forged forward threads. No malware ran, so the investigation lives in mail headers and accounting records.
Reality
KnowBe4's Threat Lab logged the messages across July and August 2026. None of them needed a stolen password to look like mail from HR or accounting, and a single send addressed 900 recipients. The report landed September 10.
Reality