Not your inbox

You are not the one this control protects.

DMARC gets filed with the tools that keep bad mail out of your company. That is not its job. It has no opinion about what reaches your desk. It governs mail that claims to come from you. Your brand, in your customers’ inboxes.

Spoofing is forgery: faking who a message is from. Phishing is the con: getting a person to do something. Forgery is one way to run the con.

The forgery is the half DMARC governs. Your domain publishes one instruction, and the mail servers that check it — most large mail providers do — obey it on any message claiming to be you that is not: watch it, quarantine it, or reject it. Watching reports what it saw and delivers the message anyway. Quarantine sends it to spam. Reject refuses it.

Watching is not a resting state. Its reports exist to find the systems sending as you — the marketing platform, the invoice sender — so enforcing does not stop your own mail. Watch-only means the work was started and not finished.

Of 147 dealership software brands we assessed, 38 publish a policy set only to watch. Check yours: search for a DMARC checker, enter your domain, read the policy back. If it reports p=none, you are watching. Mail forged as you reaches your customers, and you are the only party who can stop it. That is not negligence. It is usually nobody’s job.

Now what DMARC misses. Someone registers a domain one character off yours and sends from it. That mail really is from their domain, so it passes DMARC, theirs. Yours governs your domain, nothing else.

A friend’s company had a phishing attempt. The controls in place were not enforcing. One person recognized it and escalated it. If you can’t be good, at least be lucky.

That person is the good part. Training plus a route to report is a real control with a name. Enforcement stops forgery of your exact domain every time it is checked.

Then the next question. What stops a message that looks like it is from us but was never sent from our domain? If the answer is a product name, it is not an answer yet.

If you operate a brand serving automotive retail, we will tell you whether you are in the sample. Request your scorecard.