You're right - they're not really hard. Dealing with their consequences can be though. The real problem is that they are tacked on solutions...and that's why yo

You're right - they're not really hard. Dealing with their consequences can be though. The real problem is that they are tacked on solutions...and that's why you end up with things like ARC (https://en.wikipedia.org/wiki/Authenticated_Received_Chain https://en.wikipedia.org/wiki/Authenticated_Received_Chain) which as far as I can see is a way of getting around the problems that DMARC creates for so many setups.