A domain at p=reject with every sender aligned has closed exactly one attack: mail claiming to come from that domain. Everything else on this list still works, and being able to enumerate it is what separates a practitioner from a compliance exercise.
What still works
| Technique | What the recipient sees | Why your policy does not apply |
|---|---|---|
| Display-name spoofing | “Jane Smith, Finance” <random@gmail.com> | The From domain is gmail.com. Their policy governs, and gmail.com is not being spoofed. |
| Lookalike domains | billing@exarnple.com | A different domain entirely, registered by the attacker, who publishes their own perfect DMARC record. |
| Subdomain of a lookalike | invoices.example.com.secure-billing.net | Reads as your domain and is a subdomain of theirs. |
| Compromised mailbox | A genuine colleague’s address | It is genuinely their mail, sent by an attacker holding their credentials. |
| Compromised supplier | A real supplier’s real domain | Their authentication is fine. The message is fraudulent and authentic at once. |
| Reply-To redirection | Your domain in From, attacker in Reply-To | Reply-To is not part of any authentication check. |
Enforcement moves the attacker, it does not remove them
Before: spoof example.com directly. cheap, instant
After: register exarnple.com ~$10, one day
publish SPF, DKIM, DMARC on it an hour
send perfectly authenticated fraud
The cost went from nothing to an afternoon. That is
a real improvement and it is not a wall.This is the honest framing. Enforcement raises the cost and removes the easiest option; it does not make the domain unusable for fraud. A practitioner who says otherwise is contradicted the first time a lookalike arrives.
What addresses the remainder
| Residual | Control | Where it lives |
|---|---|---|
| Lookalike domains | Registration monitoring and certificate-transparency watching | Track 2 |
| Display-name spoofing | Inbound filtering and client warnings | Not yours as the sending domain |
| Compromised mailboxes | MFA, session monitoring, conditional access | Identity, not DNS |
| Supplier compromise | Out-of-band verification for payment changes | Process, not technology |
None of that makes enforcement less worth doing
Direct spoofing is the cheapest attack and the one that scales. Removing it is the highest-value thing a domain owner can do unilaterally, and it costs a quarter of part-time work. The point of enumerating the residual is to set expectations, not to discourage the work.