DMARC's Real Powers and Its Blind Spots

What DMARC Protects You From, and What It Does Not

DMARC is often mistaken for a spam or phishing filter, but it only verifies that the visible From address is authorized via aligned SPF or DKIM. This article clarifies what DMARC actually protects against—exact-domain spoofing—and what it doesn't: lookalike domains, display-name impersonation, compromised mailboxes, and authenticated malicious senders. It also explains the mechanics of SPF, DKIM, and DMARC alignment, and warns that reaching p=reject without addressing these gaps creates a false sense of security.