DMARC Alignment Breaks for SaaS Offers and Mailing-List Notices
Meridian Credit Union publishes DMARC p=quarantine, sp=quarantine, pct=100; SPF -all; DKIM selector s1. Its ESA signs all outbound mail with d=meridian-cu.example. Marketing uses a SaaS platform that sends loan-offer emails with header From [email protected] but envelope From [email protected]; the SaaS platform DKIM-signs with d=saas-provider.example. Several recipients quarantine these offers. Separately, a payroll provider sends direct deposit notices through a mailing list; those messages fail DMARC at Meridian's inbound ESA and are quarantined, although they are legitimate. The security team wants to keep p=quarantine and avoid blocking legitimate mail, and also requires that any outbound message containing an account number to a partner domain be encrypted.
1. Why are the SaaS loan-offer messages failing DMARC, and what two compliant fixes would you propose?
Read the worked answer
DMARC requires identifier alignment: the domain in the header From must align with an authenticated SPF domain or an authenticated DKIM d= domain. Here the header From is meridian-cu.example, but the envelope domain is saas-provider.example and the DKIM signature is d=saas-provider.example. SPF may pass for the SaaS platform, and DKIM may pass for the SaaS platform, but neither authenticates meridian-cu.example. With p=quarantine, receivers apply quarantine.
Two compliant fixes:
- Have the SaaS platform DKIM-sign with d=meridian-cu.example using a selector whose public key is published under Meridian's DNS. The platform may use a CNAME to Meridian's key record. Then DKIM passes and aligns with the header From.
- Send the offers from a dedicated subdomain, for example offers.meridian-cu.example, with its own SPF and DKIM alignment and its own DMARC subdomain policy. Do not simply change the envelope From while leaving the header From unaligned.
After the change, verify with an external DMARC tester that both SPF or DKIM pass and alignment passes.
2. The payroll notices via the mailing list are legitimate but fail DMARC. How would you handle this without weakening DMARC for all senders?
Read the worked answer
First confirm the failure mode from message tracking: the mailing list may rewrite the header From, or forwarding may break SPF while DKIM is absent. DMARC cannot validate a message whose aligned identifier was altered in transit; that is a known limitation, not an ESA bug.
The safe approach is scoped, not global:
- Ask the payroll provider or list operator to preserve DKIM alignment or to send from a domain they control with its own DMARC policy.
- If the business accepts the residual risk, create a narrowly scoped mail policy or content filter for the known list server's IP range or envelope domain that does not quarantine solely on DMARC failure. Document the exception and review it.
- Do not change p=quarantine to p=none for the whole domain, and do not disable DMARC verification globally.
For the encryption requirement, build a content filter that matches messages to the partner domain containing an account-number pattern and applies the approved encryption profile; test it separately from the DMARC exception so the two controls do not mask each other.