SPF/DKIM/DMARC authentication is fragile and produces false trust, forcing endless manual blocklisting

Summary

Setting up MX, SPF, DKIM and DMARC is error-prone and poorly explained, yet even when it is 'correct' it does not do what users think it does. Attackers send phishing through Amazon SES from their own newly registered lookalike domains so SPF, DKIM, DMARC and compauth all pass, and major filters like Exchange Online Protection deliver it straight to the inbox. Worse, legitimate institutional mailboxes get compromised and pass every authentication check, so companies treat fraudulent data requests as authentic and leak customer data. The practical consequence for indie operators and small studios is that authentication gives a false sense of safety, IP blocking is pointless on shared sending infrastructure, and the only remaining defense is manually maintaining tenant allow/block lists of sender domains, URLs and lookalike TLDs — a reactive, endless, unmanaged chore that no tool handles for small teams. There is no accessible service that continuously monitors, explains, and defends a small business domain against authenticated spoofing, so the problem stays unsolved and painful.