Internal explanation

A DMARC pass means the message met authentication and alignment checks for the domain in its From address. It does not confirm that the domain belongs to the company you expected.

Before acting on a request to change a payment, share credentials or move a conversation, check the exact sender domain and verify the request through an established contact method.

If the message looks suspicious, preserve it and report it through our normal security process.

Source: DNSTwister — https://dnstwister.com/resources/