Topic
DKIM and DMARC are email authentication standards using DNS-published cryptographic signatures and policy records to verify sender domains and curb spoofing.
Transactional mail can pass SPF and DKIM and still fail DMARC when neither aligns with the visible From domain, a dev.to Node.js guide shows. Because forwarding breaks SPF, the author treats aligned DKIM as the path to protect.
Reality
GitHub's SPF record uses all 10 DNS lookups RFC 7208 allows once the includes inside its vendors' records are counted. One more mail vendor would make SPF return PermError and leave GitHub's mail to pass DMARC on DKIM alone.
Reality
Publishers onboarding custom domains should confine wildcard DNS to routing and verify three mail records per tenant, a dev.to guide argues. That costs extra writes and waiting, and it gives every customer its own rollback boundary and audit trail.
Reality
The request came from an unauthorized account on a real government domain, and Revolut acted on it. The company calls the number of affected customers limited, and it declined to say how many or name the agency.
Perspective Coverage
5 publishersReality
Publishing p=none starts an XML report feed and enforces nothing. A practitioner sequence for getting a domain to p=reject turns on an owned sender inventory, aligned DKIM and a written condition for each step.
Reality
RFC 9989 removed the pct tag on 19 May 2026, and a record still carrying pct=25 describes a staged rollout that conforming receivers no longer honour. The replacement, t=y, gives one testing step and no percentages.
Reality
In four codebases a dev.to author found bounce handlers that read 5.x.x and stopped, so a receiver's verdict on the sending domain got written down as a dead mailbox. The RFC 3463 subject digit separates the two.
Reality
The DNS and header half of deliverability is a pure function of your own configuration, so a scheduled job can assert it; inbox placement is a measurement you put on a dashboard with a date on it.
Reality
A dev.to walkthrough splits outbound mail by risk profile. Whether that split changes anything for receivers comes down to one tag: sp= on the organizational domain. Subdomains still need their own SPF and DKIM either way.
Reality
A dev.to runbook for property-management DNS ties every record to a property ID, plans each delete against an expected current value, and calls the job done only once resolver checks agree.
Reality
A dev.to walkthrough traces a newsletter whose SPF and DKIM both pass for example.net while the visible From reads editorial.example. The evidence that settles it sits in the receiver's Authentication-Results header.
Reality
The request arrived from what looked like a government agency's domain, cleared all three email authentication checks, and Revolut's compliance team processed it. Notifications to affected customers began on September 11.
Reality
A dev.to onboarding design keeps the SPF, DKIM and DMARC values you generated in one row and the answers a resolver returned in another. Its comparator is a single stripped string match, so an SPF value the customer appended to lands in drifted.
Reality
The decision to automate tenant subdomains turns on whether you can test intent, confirm the authoritative answer and reverse a record, and a dev.to field guide keeps a checklist for anything below that bar.
Reality
Microsoft Security Research reported over a million emails pairing fake ServiceNow invoices with forged forward threads. No malware ran, so the investigation lives in mail headers and accounting records.
Reality
KnowBe4's Threat Lab logged the messages across July and August 2026. None of them needed a stolen password to look like mail from HR or accounting, and a single send addressed 900 recipients. The report landed September 10.
Reality
Daniel Jones of Tuxxin describes a landing page that fingerprints each visitor before it serves anything, so the reputation engines checking it from datacenter IPs recorded a harmless skeleton while real phones were handed a 148 MB installer.
Reality
A genuine Carnival booking confirmation passed SPF, DKIM and DMARC and pointed at a promotional domain the company had let lapse. Someone re-registered it, wired it into a cloaking network, and the link kept routing for 74 days.
Reality
The email telling Trezor owners their recovery phrases might lack entropy came from a real trezor.io address and passed DKIM, SPF and DMARC, and it described a defect close to the one that took 1,778.84 BTC from Coldcard users.
Reality
The native binding wants the Workers Paid plan, and until Cloudflare's SPF, DKIM, DMARC and cf-bounce records are live it will mail only the destinations you verified by hand. That window picks your integration for you.
Reality
Build · August 29, 2026 · 1 publisher
Build · August 28, 2026 · 1 publisher
Build · August 24, 2026 · 1 publisher
Build · August 20, 2026 · 1 publisher