Two domains, one company, and only one of them protected

It is a common and usually historical arrangement. It also quietly halves the protection most companies believe they have.

Of the 95 companies we measured, 11 send their email from one domain and run their website on another. The address on the business card and the address in the browser are two different names for one business.

There is usually a good reason. The company was renamed and kept the old mail. A shorter domain was bought for email because the real one is long. A country domain was added and the website moved but the mailboxes did not.

Why it matters more than it looks

Email authentication is anchored to the domain a human actually sees. DMARC works by requiring that the visible From address matches an identifier that was genuinely authenticated, which the specification calls identifier alignment. The domain in the From line is the one that carries the protection.

So a company with two domains has two separate jobs, and in our sample the second one is almost always missed. The mail domain gets SPF, DKIM and a DMARC policy, because somebody had to configure it to make mail work at all. The website domain gets nothing, because nothing obliges it to.

That leaves the name printed on every page of the website completely open. Anyone can send mail appearing to come from it, to your clients, and nothing in the system objects. In one case we measured, the mail domain was correctly set to reject and the website domain had no record at all, both pointing at the same server.

What to do about it

• List every domain the business owns, including the ones nobody uses.
• Publish a DMARC record on all of them. Domains that never send mail should say so: a policy of reject with an empty SPF record tells the world that nothing legitimate ever comes from there.
• Decide which domain is the company. Two names in circulation is a marketing problem before it is a security one, and clients notice.