> Can you have a policy like that? No you cannot, like you said: DMARC passes if either SPF or DKIM passes. But what you can do is use the 'aspf' and 'adkim'

> Can you have a policy like that? No you cannot, like you said: DMARC passes if either SPF or DKIM passes. But what you can do is use the 'aspf' and 'adkim' settings to force strict alignment on SPF and/or DKIM for DMARC to pass. We see some of our [0] customers using strict SPF alignment to basically force DMARC SPF alignment to fail most of the time, thus effectively forcing a DKIM requirement for DMARC to pass. We wouldn't recommend doing this though, unless you are already closely monitoring your email traffic, and getting close to 100% DMARC alignment. Note that none of this would have helped against the vulnerability discovered in the OP though. [0] https://www.mailhardener.com https://www.mailhardener.com