Glossary › Patterns › Email authentication
Reference · Pattern

SPF configured without DMARC alignment

Severity HighKind Email authenticationEffort to fix TrivialUpdated 7 Oct 2026By LeakTrace
Definition

A domain publishes an SPF record but no DMARC policy, leaving receivers with no instruction on how to handle unauthenticated mail.

What it is

SPF (Sender Policy Framework) tells receiving mail servers which IPs are allowed to send mail for a domain. DMARC (Domain-based Message Authentication, Reporting, and Conformance) tells those receivers what to do when mail fails SPF or DKIM alignment, reject, quarantine, or monitor. Publishing SPF without DMARC is the equivalent of installing a burglar alarm and never turning it on.

Why it matters

Attackers targeting a firm for business email compromise (BEC) or wire-fraud pretext will test the domain's DMARC policy before staging the impersonation. A missing or permissive DMARC policy (p=none, or no record at all) means spoofed mail from the domain is likely to reach the inbox without a warning label.

The check behind the finding

nslookup -type=txt _dmarc.yourfirm.ca

If nothing comes back, there is no policy. If it says p=none, forged mail is still delivered.

Closing it

This can be closed. It is done in stages, so that none of the firm's real mail is lost on the way: every service that sends mail for the domain is confirmed first, and only then is the policy tightened. The assessment gives the exact steps for the domain.

The outside watch for your firm: see what is open before anyone else does, with the proof for the lead finding. Check my firm →