DMARC solves part of the problem. There are many attack vectors when it comes to email. For a more sophisticated con it is usually much easier to register a dom

DMARC solves part of the problem. There are many attack vectors when it comes to email. For a more sophisticated con it is usually much easier to register a domain that looks like the victim domain. However, the real problem (as what happened with SPF) is that many email services have really, really poor implementation of the RFCs. Most make it impossible to even reach DMARC alignment. If just one of the mail services you use does not meet DMARC requirements, you can't enable DMARC for your domain. The result is that DMARC implementers (the receivers) still need to take DMARC alignment with a grain of salt, and may still pass email even if it does not align. The biggest part of internet users don't care about security, they just want their email to reach the destination. As long as large email services don't follow the RFCs (expensive 'enterprise' email software vendors are the worst offenders), the receivers cannot implement any kind of strict checking.