SPF configured without DMARC alignment

SPF (Sender Policy Framework) tells receiving mail servers which IPs are allowed to send mail for a domain. DMARC (Domain-based Message Authentication, Reporting, and Conformance) tells those receivers what to do when mail fails SPF or DKIM alignment — reject, quarantine, or monitor. Publishing SPF without DMARC is the equivalent of installing a burglar alarm and never turning it on. ## Why attackers exploit it Attackers targeting a firm for business email compromise (BEC) or wire-fraud pretext will test the domain's DMARC policy before staging the impersonation. A missing or permissive DMARC policy (`p=none`, or no record at all) means spoofed mail from the domain is likely to reach the inbox without a warning label. This is the single most common precursor to wire-fraud pretext against advisor-tenant firms, family office staff, and sports agency business affairs teams. ## Remediation direction Publishing a DMARC record at `_dmarc.` with `p=quarantine` (or `p=reject` once legitimate sending is verified) closes the exposure. Start in monitor mode (`p=none` with `rua=` reporting) for two weeks to catalog every legitimate sender, then escalate the policy. Institutional-grade programs pair DMARC with DKIM signing on every legitimate sending path (marketing platform, ticketing system, ATS, e-sign vendor, etc.).