DMARC verifies a domain owner authorised an email; it does not verify the email is safe. Where DMARC helps, where it falls short, and why authentication is not trust.