You have reached p=reject. Nobody can send mail with your exact domain in the From header any more. That is a genuine and substantial achievement, and it is worth being exact about its boundaries — because the most expensive outcome of a successful DMARC project is an organisation that now believes it has solved impersonation.
What it does stop
Exact-domain spoofing, completely and permanently. A message displaying From: ceo@acme.com that did not come from an authenticated Acme sender is refused at every receiver honouring the policy. That was the cheapest attack available against you, and it is gone.
What it does not stop
| Technique | What the reader sees | Why DMARC is not involved |
|---|---|---|
| Display-name spoofing | "Acme CEO" <ceo@gmail-account.example> — and on mobile, often just "Acme CEO". | The address genuinely belongs to the sender. Their own DMARC passes. Your policy is never consulted. |
| Lookalike domains | ceo@acrne.com — r and n, not m. | A different domain, with its own SPF, DKIM and DMARC, all passing. It is authenticated as itself. |
| Combosquatting | billing@acme-invoices.com | Also a different domain, and the brand name is spelled correctly so typo defences miss it. |
| Compromised accounts | A real message from a real @acme.com mailbox. | It authenticates perfectly, because it is genuine mail from a genuine account under someone else’s control. |
| Compromised supplier | A real message from a real supplier, on a thread you were already having. | Their domain, their authentication, all correct. The most effective invoice fraud works this way. |
The claim to avoid making
"We have DMARC at reject, so we are protected from phishing" is the sentence to watch for. DMARC eliminated one technique. Business email compromise overwhelmingly uses the ones in the table above — precisely because they are unaffected by it, and increasingly because so many targets have deployed DMARC.
What addresses the rest
- Display-name spoofing — receiver-side and user-side. External-sender warning banners, rules flagging a display name matching an internal person from an outside address, and training that teaches people to read the address rather than the name.
- Lookalike domains — you cannot prevent registration, so the controls are detection and response: monitoring for permutations of your name, watching certificate issuance, and having a takedown route ready before you need it.
- Compromised accounts — an identity problem. Multi-factor authentication, conditional access, anomaly detection on sending behaviour.
- Compromised suppliers — a process problem. Payment changes verified out of band, over a channel not established by the message requesting the change.
Where this goes
The second and third of those are the subject of the Domain and Brand Security track, which starts from DNS itself and works up through DNSSEC, registrar control, dangling records and the impersonation techniques above. If you finish this course and stop, you have done the most valuable single thing available and you have done roughly half the job.
This course: nobody can BE you
Next track: nobody can convincingly RESEMBLE you,
and nobody can take away your ability to be you