What DMARC solves is that you can allow a service to originally send email on behalf of a domain. It does this by adding a 'alignment' requirement for SPF and D

What DMARC solves is that you can allow a service to originally send email on behalf of a domain. It does this by adding a 'alignment' requirement for SPF and DKIM, on top of the simple pass/fail mechanism. - For SPF alignment the domain part of the rfc5321.mailfrom and rfc5322.from must match. - For DKIM alignment, the public key must be published under the domain found in the rfc5322.from address. If either SPF or DKIM is aligned the email is considered a DMARC pass. Since SPF alignment breaks with forwarding (amongst other horrible flaws), it is common practice to focus on DKIM and not rely on SPF. Once an email is DKIM aligned (thus passes DMARC), it will remain aligned if the email is forwarded. This is by design, so that DMARC will not break forwarding. The email in the article was originally DKIM aligned (thus passed DMARC inspection), then forwarded. There are various strictness settings in SPF, DKIM and DMARC in both the DNS records and the email headers, but none will prevent forwarding of email.