Hey, when I'm wrong I need to cowboy up. My post blasting dmarcian for blowing it at Huntington Bank missed by a mile. Turns out, the "Huntington.com" was really sent from "Huntinton.com." As a result, it would not have been rejected by the Huntington DMARC system.
Count one against Mad Max. That's two now, against 167 posts (I missed one state that had DMARC enforcement turned on, too).