SPF, DKIM, and DMARC: Why “Valid” Records Still Let Your Domain Be Spoofed

Having SPF, DKIM, and DMARC records is the easy half. Whether they actually stop a forged email is decided by a few qualifiers most checkers ignore — ~all vs -all, p=none vs reject, MTA-STS testing vs enforce. Presence versus enforcement, term by term.