this article takes more time to read than dmarc takes to implement

Kind of a weird post, since it acknowledges in the first 1/3rd that you don't need DMARC for PCI compliance.

> The best practice is a policy banning PAN over email, instant messaging, SMS, and chat entirely.

Sounds silly to me. A PAN should never even touch an employee's computer.

Took me too long to realize this has nothing to do with the Peripheral Component Interconnect or Direct Memory Access

two words: compensating control.

(But also setup dmarc)