the receiver
Message
Visible from
ceo@chronos.orbital
Author domain · DMARC aligns to this
chronos.orbital
Author domain from Visible from
SPF domain · MAIL FROM
chronos.orbital
SPF Pass · input
Signing domain · d=
chronos.orbital
DKIM Pass · input
Authenticated identifiers · inputs, not DMARC Pass yet
Author domain
chronos.orbital
DNS · DMARC Policy TXT
Policy at _dmarc.chronos.orbital
v=DMARC1;
p=quarantine;
aspf=r;
adkim=r
aspf / adkim relaxed (r) by default · Policy is preference
Author domain ↔ Authenticated identifier
Author domain
chronos.orbital
vs
Signing domain · d=
chronos.orbital
Does an Authenticated identifier align with Author domain?
Relaxed alignment: mail.chronos.orbital can align with Author domain chronos.orbital (same Organizational domain).
Policy preference · on Fail only
p=quarantine
Domain owner preference · the receiver decides
Author domain → Auth → Align → Pass/Fail → (Fail) Policy
A pass is not safe. The policy is a preference.
DMARC passes when SPF or DKIM passes with a domain that aligns with the author domain.
It does not prove payload safety or person identity.
On Fail, p= states a preference · the receiver decides
Mnemonic: Author domain → Auth → Align → Pass/Fail → (Fail) Policy