Capcom's Notification of "CAPCOM ID Unauthorized Access" Received, but Isn't Their Security Configuration Way Too Lax?

I recently received a data breach notification email from Capcom titled "Apology and Notice Regarding Customer Information Affected by Unauthorized Access to CAPCOM ID."

The email alias service I use, SimpleLogin, flagged this official notice with the following warning right at the top:

"This email failed anti-phishing checks when it was received by SimpleLogin, be careful with its content."

Upon checking the actual email headers, it was configured as follows:

ARC-Authentication-Results: i=1; mail.protonmail.ch; dmarc=fail (p=none dis=none) header.from=capcom.com; spf=pass smtp.mailfrom=fc8573.cn-0005.jp; dkim=pass (1024-bit key) header.d=dkim.cuenote.jp header.i=[@]dkim.cuenote.jp

It is a DMARC authentication failure (dmarc=fail).

Capcom is using an external email delivery service to send out these notifications in bulk, but the authentication results indicate that the message failed DMARC alignment checks. Although SPF and DKIM both passed individually, neither appears to have aligned with the capcom.com domain in the From address.

Looking up Capcom's actual DNS records reveals the following configurations:

• SPF Record: v=spf1 include:***.com ~allThe mechanism ends with "~all" (SoftFail). This means that emails from unauthorized senders are treated as SPF SoftFail rather than a definitive pass. It does not explicitly require receiving servers to reject such emails, so they may still be delivered depending on the recipient's filtering policies.
• DMARC Record: v=DMARC1; p=none; rua=mailto:***[@]***.comTheir DMARC policy is set to "p=none" (monitor only). This means the domain owner does not request receiving servers to quarantine or reject emails that fail DMARC authentication. Although receiving providers may apply their own anti-phishing measures, this policy itself does not request any specific protective action.

Despite these email security settings, Capcom included the following advisory within the email text:

"Advisory to Customers"

The email address registered to your CAPCOM ID account may continue to be used without interruption. However, there is a possibility that the affected information could be misused to send fraudulent emails or other communications impersonating Capcom or related parties.

Before telling users to stay vigilant, Capcom should first ensure that its own official emails are properly authenticated and that it has appropriate measures in place to address spoofing risks.

If Capcom uses an external email delivery service to send official notifications, it should ensure that the service is properly configured so that its emails can be authenticated. If it wants to prevent spoofing, it should also consider moving to a policy that quarantines or rejects emails that fail authentication, once all legitimate sending sources have been properly verified.

Yet Capcom's DMARC policy remains set to p=none, which does not request receiving servers to quarantine or reject emails that fail authentication.

I see little sense of responsibility from Capcom as the company responsible for this data breach. I seriously question whether it is genuinely committed to preventing secondary damage, such as phishing scams.

What do you guys—especially tech folks and security experts—think about this?

Also, to all Capcom gamers out there, can you really accept them leaving their email authentication policies in this state?