CertaDNS
Skip to lesson

What None of It Stops · lesson 1 of 3

Residual risk after reject

After this lesson you can

State precisely what remains possible against a domain at full enforcement.

Assumes you have read Explaining it to people who do not run DNS.

A domain at p=reject with every sender aligned has closed exactly one attack: mail claiming to come from that domain. Everything else on this list still works, and being able to enumerate it is what separates a practitioner from a compliance exercise.

What still works

TechniqueWhat the recipient seesWhy your policy does not apply
Display-name spoofing“Jane Smith, Finance” <random@gmail.com>The From domain is gmail.com. Their policy governs, and gmail.com is not being spoofed.
Lookalike domainsbilling@exarnple.comA different domain entirely, registered by the attacker, who publishes their own perfect DMARC record.
Subdomain of a lookalikeinvoices.example.com.secure-billing.netReads as your domain and is a subdomain of theirs.
Compromised mailboxA genuine colleague’s addressIt is genuinely their mail, sent by an attacker holding their credentials.
Compromised supplierA real supplier’s real domainTheir authentication is fine. The message is fraudulent and authentic at once.
Reply-To redirectionYour domain in From, attacker in Reply-ToReply-To is not part of any authentication check.

Enforcement moves the attacker, it does not remove them

Before:  spoof example.com directly.       cheap, instant
After:   register exarnple.com                ~$10, one day
         publish SPF, DKIM, DMARC on it       an hour
         send perfectly authenticated fraud

The cost went from nothing to an afternoon. That is
a real improvement and it is not a wall.

This is the honest framing. Enforcement raises the cost and removes the easiest option; it does not make the domain unusable for fraud. A practitioner who says otherwise is contradicted the first time a lookalike arrives.

What addresses the remainder

ResidualControlWhere it lives
Lookalike domainsRegistration monitoring and certificate-transparency watchingTrack 2
Display-name spoofingInbound filtering and client warningsNot yours as the sending domain
Compromised mailboxesMFA, session monitoring, conditional accessIdentity, not DNS
Supplier compromiseOut-of-band verification for payment changesProcess, not technology

None of that makes enforcement less worth doing

Direct spoofing is the cheapest attack and the one that scales. Removing it is the highest-value thing a domain owner can do unilaterally, and it costs a quarter of part-time work. The point of enumerating the residual is to set expectations, not to discourage the work.

Try it on a real domain

Free, no account, public DNS only.

Last reviewed