Authenticate first, evaluate second: What DMARC teaches us about AI agent identity

TLDR: AI has gotten good enough at writing messages that spotting fake ones is a losing race. The better answer is the one email figured out a decade ago: verify who sent something before you evaluate what they sent. That principle is about to matter a lot more because the senders showing up in your stack are no longer all human.

---

Microsoft’s 2025 Digital Defense Report found that AI-generated phishing emails pulled a 54% click-through rate. Human-written ones managed 12%. That’s the same inboxes with the same people pulling roughly 4.5x the success rate.

There’s no more grammar mistakes. No more weird formatting. The telltale signs your security awareness training taught everyone to look for have been deprecated by a machine that writes better than most of us.

Now, it’s not about getting better at spotting fakes. The better question is whether spotting fakes was ever the right game anyways.

AI can fake the message. It can’t fake the identity.

Roughly 91% of phishing attacks start the same way: the sender lies about who they are. Nobody gets a phishing email that opens by admitting it’s a phishing email. It always starts with a lie

No matter how good AI gets at writing the message, it still has to claim an identity to deliver it. And that identity claim is checkable in a way the message never was.

Content analysis has to keep improving forever because the other side keeps improving too. Identity verification doesn’t work that way. 

A sender either proves it belongs to a domain you authorized, or it doesn’t. 

That’s a binary.

Detection still matters. A lot. Secure email gateways catch things authentication can’t see, and any serious security program runs both. However, detection alone can’t carry the whole load, and AI just made the load much heavier.

Email was the training wheels

DMARC solved this same problem for email a decade ago, and it solved it by refusing to judge content at all. It asks one question: Is this sender authorized to send as this domain? 

Everything else follows from the answer.

DMARC works at internet scale, across tens of thousands of receiving systems and billions of mailboxes. It’s one of the few examples we have of an identity standard that survived contact with the real world.

“You can almost see email as the training wheels for authentication of AI agents.” – Alexander Garcia-Tobar, Strategic Advisor for AI Trust Initiatives, DigiCert

Valimail’s 2026 State of DMARC Report found that 78% of domains now publish a DMARC record, but only 42% have reached enforcement. That’s a 36-point gap between having DMARC and being protected by it. In 2025 alone, Valimail tracked more than 2.5 billion suspicious emails on behalf of customers sitting on both sides of that line.

Publishing a policy and enforcing one aren’t the same things. Whatever comes next for agent identity will run into the same distinction, probably for the same reasons.

AI agents have a trust problem

Start with the inventory question. Research says 98% of organizations have employees using unsanctioned AI, with the average shadow AI breach costing $4.2 million. More than 40% of agentic AI projects are at risk of cancellation by 2027, and that’s mostly because governance can’t keep up with deployment.

Now add the vendor side. Garcia-Tobar points out that thousands of third-party services send email on behalf of organizations, and almost every one of them is building AI agents. That’s not one agent per vendor, either. It’s several, arriving in environments where nobody has any kind of list.

Now, imagine how things could go wrong (this isn’t a hypothetical either — it’s happening already).

An agent contacts your finance system claiming to be your sales agent. The domain looks close enough. The request is plausible. It asks for a $3 million payment approval, and the receiving system has no way to check whether the sender is who it says it is because the stack was never built to ask.

“Like a bouncer at a nightclub, you don’t need to know the name of every human on the planet. You just need to know the names of the people on the list. Do the same with agents.” – Alexander Garcia-Tobar, Strategic Advisor for AI Trust Initiatives, DigiCert

Model Context Protocol (MCP) isn’t a security protocol and was never meant to be one. It defines how AI systems connect to tools and data. Authentication is simply something you put in front of it.

Four questions for any agent in your environment

Identity, authentication, policy, reporting. Those four make DMARC deployable rather than theoretical, and they don’t change when the sender stops being a person.

1. Who is it? Can you name the agent and the organization behind it, or do you only have an IP address and a prayer?
2. Can you prove it? Is there a cryptographic credential tying that agent to a domain someone actually controls?
3. What’s it allowed to do? Which systems and which data, defined ahead of time rather than after the fact.
4. How do you know it’s working? Reporting that tells you what got through, what got blocked, and what tried.

Tie agent identity to domain ownership in DNS

DigiCert’s AI Trust architecture anchors agent identity to domain ownership and publishes the policy in DNS (this follows the pattern DMARC established for email). An organization declares:

• Which agent identities it authorizes
• Which certificate authority issued their credentials
• What those agents are permitted to do

When an agent shows up, the gateway queries DNS, checks the credential, and admits or blocks it.

Here’s an example of an agent policy TXT record:

“v=AGENTDMARC; ca=digicert.com; scopes=read:*,write:jira; p=reject”

This record includes a version tag, policy tag, and a scope list where SPF would have put authorized senders.

DNS is the right control point because every agent action starts with a DNS query, whether it’s resolving an API endpoint, reaching an MCP server, or pulling a package. That makes DNS the one place policy can be enforced consistently before a connection is ever established (without touching endpoint or application code).

On top of that sits the AI Agent Passport: a tamper-evident credential bound to an agent’s workload identity that encodes:

• Approved systems
• Permitted operations
• Data sensitivity
• Expiration
• Accountable human

Identity is issued once and can’t be altered. Permissions work more like visas, scoped and revocable, with a kill switch that cuts access across connected systems when an agent misbehaves.

These capabilities are in preview at DigiCert already, and the standards around agent identity are still being written. But the architecture is published, and the shape looks familiar to anyone who’s deployed DMARC.

Start with the senders you already have

Agent identity is a 2027 (and beyond) problem you can prepare for with a 2026 decision. The foundation is the same either way: 

1. Domain ownership you control
2. Cryptographic proof you can verify
3. Policy you set and enforce

Domains that never reached DMARC enforcement will find themselves building agent trust on the same ground they never finished securing.

Valimail pioneered the path toward email authentication through DMARC, and now we’re using that expertise to blaze this new trail to deal with AI agent threats at scale.

If you don’t know who’s sending as your domains right now, that’s the best place to start. Valimail Monitor shows you every service sending on your behalf, by name, for free. 

Frequently asked questions